VDB
DEBIAN-CVE-2015-3900
DEBIAN-CVE-2015-3900
PUBLISHED
Record from OSV · Published June 24, 2015
RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| jruby | Debian:14 | 1.7.20.1-2 |
| jruby | Debian:12 | 1.7.20.1-2 |
| jruby | Debian:13 | 1.7.20.1-2 |
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Debian:14 | jruby | 0 |
| Debian:12 | jruby | 0 |
| Debian:13 | jruby | 0 |
Timeline
- Jun 24, 2015 CVE Published
- Sep 9, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln DEBIAN-CVE-2015-3900
vulnetix vdb fixes DEBIAN-CVE-2015-3900Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/DEBIAN-CVE-2015-3900/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart