Critical DNS Hijacking Vulnerability in Ruby Package
Summary
ALPINE-CVE-2017-0902: RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls. Affects ruby versions < 2.4.2-r0. Fixed in 2.4.2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Ruby is a dynamic, open-source programming language with a focus on simplicity and productivity. It has an elegant syntax that is natural to read and easy to write. RubyGems is the package manager for Ruby, allowing users to easily install and manage Ruby libraries and applications. However, a vulnerability has been identified in RubyGems versions 2.6.12 and earlier, which exposes users to potential DNS hijacking attacks.
Vulnerability Detail
The vulnerability arises from a flaw in RubyGems that allows a man-in-the-middle (MITM) attacker to manipulate the RubyGems client. This manipulation can force the client to download and install gems from a malicious server controlled by the attacker, rather than the intended source. The ramifications of this vulnerability include the potential installation of compromised or malicious code, which could lead to data breaches, unauthorized access, or system compromise. The CVSS score for this vulnerability is 8.1, indicating a high severity level.
How To Fix
Minimum fixed version
2.4.2-r0
This is the first release that contains the fix.
sudo apk add --upgrade rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using RubyGems for downloading gems until they have updated to a secure version. Additionally, users can verify the integrity of gems by checking their signatures before installation.
Conclusion
The identified DNS hijacking vulnerability in RubyGems poses a significant risk to users, allowing attackers to manipulate gem downloads. It is crucial for users to update to the latest version of RubyGems to mitigate this risk. Utilizing tools like Vulert can further enhance security by monitoring for vulnerabilities in real-time.
See every vulnerability recorded for ruby →
FAQ
The vulnerability allows a MITM attacker to redirect the RubyGems client to download gems from a malicious server.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The consequences include the risk of installing malicious gems, which could lead to data breaches or system compromises.
Yes, upgrading to RubyGems version 2.6.13 or later will patch the vulnerability.
Vulert monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json, providing real-time insights without requiring code access.
References
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
