Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

RubyGems Fails to Verify SSL Certificates, Allowing Tampering

CVE-2012-2126 · published 13 years ago
Summary

The RubyGems package manager doesn't check if a connection to a gem repository is secure, making it possible for an attacker to intercept and alter a gem installation. This could allow an attacker to inject malicious code into a gem, potentially compromising a system. Update to a version of RubyGems that addresses this issue to ensure secure gem installations.

What to do
  • Update jim weirich rubygems-update to version 1.8.23.
Affected software
Ecosystem VendorProductAffected versions
rubygems jim weirich rubygems-update < 1.8.23
Fix: upgrade to 1.8.23
– rubygems rubygems <= 1.8.22
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.8.8
1.8.9
1.8.10
11 more version ranges
cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*
Original advisory text
RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack.
RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack.
References
Severity
4.3 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-310Cryptographic Issues
Timeline
Published1 Oct 2013
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-5mgj-mvv8-46mw · GHSA
CVE-2012-2126 · NVD
Track software like this
Free during beta