CVE-2015-4020 RubyGems Improper Input Validation vulnerability

What is CVE-2015-4020?

CVE-2015-4020 is a medium-severity server-side request forgery vulnerability in Oracle Solaris, published on 25 Aug 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a "DNS hijack attack." NOTE: this vulnerability exists because to an incomplete fix for CVE-2015-3900.

Weakness: CWE-20

Which versions are affected by CVE-2015-4020?

6 open source packages ship an affected version, including rubygems-update. It affects 2 products.

Products include Oracle Solaris, Rubygems Rubygems.

How do I fix CVE-2015-4020?

Upgrade rubygems-update to a fixed version for your release line: 2.0.17, 2.2.5 or 2.4.8.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2015-4020 being exploited?

There is no known exploitation of CVE-2015-4020 in the wild and no public exploit code.

Other vulnerabilities in Oracle Solaris

• CVE-2020-14871 Oracle Solaris and Zettabyte File System (ZFS) Unspecified Exploited Critical 10.0
• CVE-2019-3010 Oracle Solaris Privilege Escalation Exploited High 8.8
• CVE-2026-46978 Missing authorization in Oracle Solaris Critical 10.0
• CVE-2017-3623 Other in Solaris Operating System Critical 10.0
• CVE-2014-0397 Memory corruption in n/a Critical 10.0

All Oracle Solaris vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qv62-xfj6-32xm.