CVSS: 9.8EPSS: 0%CPEs: 71EXPL: 0CVE-2013-4363
https://notcve.org/view.php?id=CVE-2013-4363
17 Oct 2013 — Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression. NOTE: this issue is due to an incomplete fix for CVE-2013-4287. Vulnerabilidad en la complejidad algo... • http://blog.rubygems.org/2013/09/24/CVE-2013-4363.html • CWE-310: Cryptographic Issues •
CVSS: 7.5EPSS: 2%CPEs: 59EXPL: 0CVE-2013-4287 – rubygems: version regex algorithmic complexity vulnerability
https://notcve.org/view.php?id=CVE-2013-4287
16 Oct 2013 — Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression. Vulnerabilidad en la complejidad algorítmicade Gem :: Versión :: VERSION_PATTERN en lib / rubygems / version.rb... • http://blog.rubygems.org/2013/09/09/CVE-2013-4287.html • CWE-310: Cryptographic Issues CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.8EPSS: 0%CPEs: 25EXPL: 0CVE-2012-2125 – rubygems: Two security fixes in v1.8.23
https://notcve.org/view.php?id=CVE-2012-2125
04 Sep 2013 — RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack. RubyGems anteriores a 1.8.23 pueden redirigir conexiones HTTPS a HTTP, lo cual facilita a atacantes remotos observar o modificar una gema durante la instalación a través de un ataque man-in-the-middle. Red Hat Enterprise MRG is a next-generation IT infrastructure for enterprise computing. MRG offers increased performance, rel... • http://rhn.redhat.com/errata/RHSA-2013-1203.html •
CVSS: 4.3EPSS: 0%CPEs: 25EXPL: 0CVE-2012-2126 – rubygems: Two security fixes in v1.8.23
https://notcve.org/view.php?id=CVE-2012-2126
04 Sep 2013 — RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack. RubyGems anteriores a 1.8.23 no verifican un certificado SSL, lo cual permite a atacantes remotos modificar una gema durante la instalación a través de un ataque man-in-the-middle. Red Hat Enterprise MRG is a next-generation IT infrastructure for enterprise computing. MRG offers increased performance, reliability, interoperability, and faster computing ... • http://rhn.redhat.com/errata/RHSA-2013-1203.html • CWE-310: Cryptographic Issues •
CVSS: 9.3EPSS: 3%CPEs: 2EXPL: 0CVE-2007-0469
https://notcve.org/view.php?id=CVE-2007-0469
24 Jan 2007 — The extract_files function in installer.rb in RubyGems before 0.9.1 does not check whether files exist before overwriting them, which allows user-assisted remote attackers to overwrite arbitrary files, cause a denial of service, or execute arbitrary code via crafted GEM packages. La función extract_files en installer.rb de RubyGems before 0.9.1 no comprueba la existencia ficheros antes de sobrescribirlos, lo cual permite a atacantes remotos con la complicidad del usuario sobrescribir ficheros de su elección... • http://marc.info/?l=full-disclosure&m=116939816621060&w=2 •