USN-1582-1: RubyGems vulnerabilities
26 September 2012
RubyGems could be made to download and install malicious gem files.
Releases
Packages
- rubygems - package management framework for Ruby libraries/applications
Details
John Firebaugh discovered that the RubyGems remote gem fetcher did not properly
verify SSL certificates. A remote attacker could exploit this to perform a man
in the middle attack to alter gem files being downloaded for installation.
(CVE-2012-2126)
John Firebaugh discovered that the RubyGems remote gem fetcher allowed
redirection from HTTPS to HTTP. A remote attacker could exploit this to perform
a machine-in-the-middle attack to alter gem files being downloaded for
installation. (CVE-2012-2125)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 12.04
In general, a standard system update will make all the necessary changes.
References
Related notices
- USN-1583-1: ruby1.9.1, libruby1.9.1