CVE-2012-2126

Published: 20 April 2012

RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack.

Priority

Status

Package	Release	Status
jruby Launchpad, Ubuntu, Debian	artful	Ignored (end of life)
	bionic	Not vulnerable
	cosmic	Ignored (end of life)
	disco	Ignored (end of life)
	focal	Not vulnerable
	groovy	Not vulnerable
	hardy	Does not exist
	hirsute	Not vulnerable
	impish	Not vulnerable
	lucid	Ignored (end of life)
	lunar	Not vulnerable
	mantic	Not vulnerable
	natty	Ignored (end of life)
	noble	Not vulnerable
	oneiric	Ignored (end of life)
	precise	Ignored (end of life)
	quantal	Ignored (end of life)
	raring	Ignored (end of life)
	saucy	Ignored (end of life)
	trusty	Needed
	upstream	Needs triage
	utopic	Ignored (end of life)
	vivid	Ignored (end of life)
	wily	Ignored (end of life)
	xenial	Not vulnerable
	yakkety	Ignored (end of life)
	zesty	Ignored (end of life)
ruby1.9.1 Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Does not exist
	cosmic	Does not exist
	disco	Does not exist
	focal	Does not exist
	groovy	Does not exist
	hardy	Does not exist
	hirsute	Does not exist
	impish	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	lucid	Ignored (end of life)
	lunar	Does not exist
	mantic	Does not exist
	natty	Ignored (end of life)
	noble	Does not exist
	oneiric	Ignored (end of life)
	precise	Released (1.9.3.0-1ubuntu2.2)
	quantal	Not vulnerable (1.9.3.194-1)
	raring	Not vulnerable (1.9.3.194-1)
	saucy	Not vulnerable (1.9.3.194-1)
	trusty	Does not exist (trusty was not-affected [1.9.3.194-1])
	upstream	Released (1.9.3-p194)
	utopic	Not vulnerable (1.9.3.194-1)
	vivid	Not vulnerable (1.9.3.194-1)
	wily	Does not exist
	xenial	Does not exist
	yakkety	Does not exist
	zesty	Does not exist
	Patches: upstream: http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&sortby=date&revision=35404
rubygems Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Does not exist
	cosmic	Does not exist
	disco	Does not exist
	focal	Does not exist
	groovy	Does not exist
	hardy	Does not exist
	hirsute	Not vulnerable (3.2.5-2)
	impish	Not vulnerable (3.2.5-2)
	jammy	Not vulnerable (3.2.5-2)
	kinetic	Not vulnerable (3.2.5-2)
	lucid	Does not exist
	lunar	Not vulnerable (3.2.5-2)
	mantic	Not vulnerable (3.2.5-2)
	natty	Does not exist
	noble	Not vulnerable (3.2.5-2)
	oneiric	Ignored (end of life)
	precise	Released (1.8.15-1ubuntu0.1)
	quantal	Not vulnerable (1.8.24-1)
	raring	Not vulnerable (1.8.24-1)
	saucy	Not vulnerable (1.8.24-1)
	trusty	Does not exist
	upstream	Released (1.8.23)
	utopic	Does not exist
	vivid	Does not exist
	wily	Does not exist
	xenial	Does not exist
	yakkety	Does not exist
	zesty	Does not exist
	Patches: upstream: https://github.com/rubygems/rubygems/commit/d4c7eafb8efe1e13a7abf5be5a5b4548870b15b7

References

Bugs

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=670228

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›