Scientific Linux Security Update : rubygems on SL6.x (noarch)

Medium Nessus Plugin ID 70491

Synopsis

The remote Scientific Linux host is missing a security update.

Description

It was found that RubyGems did not verify SSL connections. This could lead to man-in-the-middle attacks. (CVE-2012-2126)

It was found that, when using RubyGems, the connection could be redirected from HTTPS to HTTP. This could lead to a user believing they are installing a gem via HTTPS, when the connection may have been silently downgraded to HTTP. (CVE-2012-2125)

It was discovered that the rubygems API validated version strings using an unsafe regular expression. An application making use of this API to process a version string from an untrusted source could be vulnerable to a denial of service attack through CPU exhaustion.
(CVE-2013-4287)

Solution

Update the affected rubygems package.

See Also

http://www.nessus.org/u?2a853c7a

Plugin Details

Severity: Medium

ID: 70491

File Name: sl_20131017_rubygems_on_SL6_x.nasl

Version: 1.2

Type: local

Agent: unix

Published: 2013/10/18

Updated: 2018/12/31

Dependencies: 12634

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 5.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N

Vulnerability Information

CPE: x-cpe:/o:fermilab:scientific_linux

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/RedHat/release, Host/RedHat/rpm-list

Patch Publication Date: 2013/10/17

Reference Information

CVE: CVE-2012-2125, CVE-2012-2126, CVE-2013-4287