Detections
Analytics
Scientific Linux Security Update : rubygems on SL6.x (noarch) (20131017)
medium Nessus Plugin ID 70491
Language:
Synopsis
The remote Scientific Linux host is missing a security update.Description
It was found that RubyGems did not verify SSL connections. This could lead to man-in-the-middle attacks. (CVE-2012-2126)It was found that, when using RubyGems, the connection could be redirected from HTTPS to HTTP. This could lead to a user believing they are installing a gem via HTTPS, when the connection may have been silently downgraded to HTTP. (CVE-2012-2125)
It was discovered that the rubygems API validated version strings using an unsafe regular expression. An application making use of this API to process a version string from an untrusted source could be vulnerable to a denial of service attack through CPU exhaustion.
(CVE-2013-4287)
Solution
Update the affected rubygems package.See Also
Plugin Details
Severity: Medium
ID: 70491
File Name: sl_20131017_rubygems_on_SL6_x.nasl
Version: 1.5
Type: local
Agent: unix
Published: 10/18/2013
Updated: 1/14/2021
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.7
CVSS v2
Risk Factor: Medium
Base Score: 5.8
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N
Vulnerability Information
CPE: p-cpe:/a:fermilab:scientific_linux:rubygems, x-cpe:/o:fermilab:scientific_linux
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/RedHat/release, Host/RedHat/rpm-list
Patch Publication Date: 10/17/2013
Vulnerability Publication Date: 10/1/2013