CVE-2017-0902CWE-350

RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and…

published August 31, 2017

CVSS
—
EPSS
5%
Percentile
91.8
In the wild
Unconfirmed
What it is

RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04750 · 91.8th percentile
Weakness
CWE-350 · Reliance on Reverse DNS Resolution for a Security-Critical Action
Published
2017-08-31T20:00Z
EPSS history
Timeline
  • 31 AUG 20:00Z
    RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and…
    cvelistv5