VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Aug 25, 2015· Updated May 6, 2026

CVE-2015-4020

CVE-2015-4020

Description

RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a "DNS hijack attack." NOTE: this vulnerability exists because to an incomplete fix for CVE-2015-3900.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
rubygems-updateRubyGems
< 2.0.172.0.17
rubygems-updateRubyGems
>= 2.1.0.rc.1, < 2.2.52.2.5
rubygems-updateRubyGems
>= 2.3.0, < 2.4.82.4.8

Affected products

36
  • RubyGems/Rubygems35 versions
    cpe:2.3:a:rubygems:rubygems:2.0.0:*:*:*:*:*:*:*+ 34 more
    • cpe:2.3:a:rubygems:rubygems:2.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.0.0:preview2:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.0.0:preview2.1:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.0.0:preview2.2:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.0.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.0.0:rc2:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.0.10:*:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.0.11:*:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.0.12:*:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.0.13:*:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.0.14:*:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.0.15:*:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.0.16:*:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.0.9:*:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.2.2:*:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.2.3:*:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.2.4:*:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.4.0:*:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.4.1:*:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.4.2:*:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.4.3:*:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.4.4:*:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.4.5:*:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.4.6:*:*:*:*:*:*:*
    • cpe:2.3:a:rubygems:rubygems:2.4.7:*:*:*:*:*:*:*
  • Oracle Corporation/Solaris
    cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*

Patches

1
5c7bfb5

Fix API endpoint domain clamping

https://github.com/rubygems/rubygemsEvan PhoenixMay 18, 2015via ghsa
commit
2 files changed · +31 −1
  • lib/rubygems/remote_fetcher.rb+1 −1 modified
    @@ -96,7 +96,7 @@ def api_endpoint(uri)
     else
       target = res.target.to_s.strip
 
-      if /#{host}\z/ =~ target
+      if /\.#{Regexp.quote(host)}\z/ =~ target
         return URI.parse "#{uri.scheme}://#{target}#{uri.path}"
       end
  • test/rubygems/test_gem_remote_fetcher.rb+30 −0 modified
    @@ -196,6 +196,36 @@ def test_api_endpoint_ignores_trans_domain_values
     dns.verify
   end
 
+  def test_api_endpoint_ignores_trans_domain_values_that_starts_with_original
+    uri = URI.parse "http://example.com/foo"
+    target = MiniTest::Mock.new
+    target.expect :target, "example.combadguy.com"
+
+    dns = MiniTest::Mock.new
+    dns.expect :getresource, target, [String, Object]
+
+    fetch = Gem::RemoteFetcher.new nil, dns
+    assert_equal URI.parse("http://example.com/foo"), fetch.api_endpoint(uri)
+
+    target.verify
+    dns.verify
+  end
+
+  def test_api_endpoint_ignores_trans_domain_values_that_end_with_original
+    uri = URI.parse "http://example.com/foo"
+    target = MiniTest::Mock.new
+    target.expect :target, "badexample.com"
+
+    dns = MiniTest::Mock.new
+    dns.expect :getresource, target, [String, Object]
+
+    fetch = Gem::RemoteFetcher.new nil, dns
+    assert_equal URI.parse("http://example.com/foo"), fetch.api_endpoint(uri)
+
+    target.verify
+    dns.verify
+  end
+
   def test_cache_update_path
     uri = URI 'http://example/file'
     path = File.join @tempdir, 'file'

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

14

News mentions

0

No linked articles in our index yet.