Scientific Linux Security Update : rubygems on SL6.x (noarch)

Medium Nessus Plugin ID 70491


The remote Scientific Linux host is missing a security update.


It was found that RubyGems did not verify SSL connections. This could lead to man-in-the-middle attacks. (CVE-2012-2126)

It was found that, when using RubyGems, the connection could be redirected from HTTPS to HTTP. This could lead to a user believing they are installing a gem via HTTPS, when the connection may have been silently downgraded to HTTP. (CVE-2012-2125)

It was discovered that the rubygems API validated version strings using an unsafe regular expression. An application making use of this API to process a version string from an untrusted source could be vulnerable to a denial of service attack through CPU exhaustion.


Update the affected rubygems package.

See Also

Plugin Details

Severity: Medium

ID: 70491

File Name: sl_20131017_rubygems_on_SL6_x.nasl

Version: $Revision: 1.1 $

Type: local

Agent: unix

Published: 2013/10/18

Modified: 2013/10/18

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 5.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N

Vulnerability Information

CPE: x-cpe:/o:fermilab:scientific_linux

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/RedHat/release, Host/RedHat/rpm-list

Patch Publication Date: 2013/10/17

Reference Information

CVE: CVE-2012-2125, CVE-2012-2126, CVE-2013-4287