CVE-2014-0036 rbovirt uses the rest-client gem with SSL verification disabled
The rbovirt gem disables SSL verification, allowing remote attackers to perform man-in-the-middle attacks and intercept sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-0036?
CVE-2014-0036 is a medium-severity vulnerability in n/a, published on 17 Apr 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors.
Weakness: CWE-310
Which versions are affected by CVE-2014-0036?
2 open source packages ship an affected version, including rbovirt. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rbovirt RubyGems | All versions | 0.0.24 |
rbovirt RubyGems | All versions | 0.0.24 |
Products include Amos Benari Rbovirt.
How do I fix CVE-2014-0036?
Upgrade rbovirt to 0.0.24 or later.
Is CVE-2014-0036 being exploited?
There is no known exploitation of CVE-2014-0036 in the wild and no public exploit code.
Sources
Also known as GHSA-ww79-8xwv-932x.