CVE-2015-4020

RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a "DNS hijack attack." NOTE: this vulnerability exists because to an incomplete fix for CVE-2015-3900.

• CWE-20

• http://blog.rubygems.org/2015/06/08/2.2.5-released.htmlVendor Advisory
• http://blog.rubygems.org/2015/06/08/2.4.8-released.htmlVendor Advisory
• http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.htmlThird Party Advisory
• http://www.securityfocus.com/bid/75431
• https://github.com/rubygems/rubygems/commit/5c7bfb5
• https://puppet.com/security/cve/CVE-2015-3900
• https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-009/?fid=6478Third Party Advisory
• https://www.trustwave.com/Resources/SpiderLabs-Blog/Attacking-Ruby-Gem-Security-with-CVE-2015-3900/Third Party Advisory
• http://blog.rubygems.org/2015/06/08/2.2.5-released.htmlVendor Advisory
• http://blog.rubygems.org/2015/06/08/2.4.8-released.htmlVendor Advisory
• http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.htmlThird Party Advisory
• http://www.securityfocus.com/bid/75431
• https://github.com/rubygems/rubygems/commit/5c7bfb5
• https://puppet.com/security/cve/CVE-2015-3900
• https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-009/?fid=6478Third Party Advisory
• https://www.trustwave.com/Resources/SpiderLabs-Blog/Attacking-Ruby-Gem-Security-with-CVE-2015-3900/Third Party Advisory

Published

Aug 25, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-4003The oz_usb_handle_ep_data function in drivers/staging/ozwpan…
• CVE-2015-4004The OZWPAN driver in the Linux kernel through 4.0.5 relies o…
• CVE-2015-4010Cross-site request forgery (CSRF) vulnerability in the Encry…
• CVE-2015-4016The client detection protocol in Valve Steam allows remote a…
• CVE-2015-4017Salt before 2014.7.6 does not verify certificates when conne…
• CVE-2015-4018SQL injection vulnerability in feedwordpresssyndicationpage.…
• CVE-2015-4021The phar_parse_tarfile function in ext/phar/tar.c in PHP bef…
• CVE-2015-4022Integer overflow in the ftp_genlist function in ext/ftp/ftp.…
• CVE-2015-4024Algorithmic complexity vulnerability in the multipart_buffer…
• CVE-2015-4025PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6…
• CVE-2015-4026The pcntl_exec implementation in PHP before 5.4.41, 5.5.x be…
• CVE-2015-4027The AcuWVSSchedulerv10 service in Acunetix Web Vulnerability…