Bug 412901 – <dev-ruby/rubygems-1.8.24: Remote Repository SSL Certificate Verification Security Issue (CVE-2012-{2125,2126})

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2012-04-21 09:56:51 UTC]

From secunia:

Description
A security issue has been reported in RubyGems, which can be exploited by malicious people to conduct spoofing attacks.

The security issue is caused due to an error when verifying SSL certificates and may allow spoofing a remote repository via e.g. Man-in-the-Middle (MitM) attacks.

The security issue is reported in versions prior to 1.9.3-p194.


Solution
Update to version 1.9.3-p194.

[Comment 1 Hans de Graaff 2012-04-21 16:57:24 UTC]

(In reply to comment #0)

> Solution
> Update to version 1.9.3-p194.

Probably not since we unbundle rubygems. We should upgrade to a newer rubygems version instead, 1.8.23 is mentioned in the ruby 1.9.3 release message.

[Comment 2 Hans de Graaff 2012-04-22 09:10:33 UTC]

dev-ruby/rubygems-1.8.23 is now in the tree.

[Comment 3 Hans de Graaff 2012-04-22 09:15:49 UTC]

We should test this version in the tree for at least a week before considering stabilization. Also, we need a newer jruby version stable first, see bug 396305.

[Comment 4 Tim Sammut (RETIRED) 2012-05-09 22:56:30 UTC]

(In reply to comment #3)
> We should test this version in the tree for at least a week before
> considering stabilization. Also, we need a newer jruby version stable first,
> see bug 396305.

jruby 1.6.5.1 has been stabilized. Is =dev-ruby/rubygems-1.8.23 fixed and are we ready to stabilize it here now? Tnx.

[Comment 5 Hans de Graaff 2012-05-10 06:37:10 UTC]

(In reply to comment #4)
> (In reply to comment #3)
> > We should test this version in the tree for at least a week before
> > considering stabilization. Also, we need a newer jruby version stable first,
> > see bug 396305.
> 
> jruby 1.6.5.1 has been stabilized. Is =dev-ruby/rubygems-1.8.23 fixed and
> are we ready to stabilize it here now? Tnx.

rubygems 1.8.23 is fixed, so potentially it can be stabilized, but I want to coordinate this with stabilization of ruby 1.9. Also, rubygems 1.8.x was a big step compared to our previous stable version (e.g. obsoleting the gems.eclass ebuilds) so I wanted to stable a proven version first.

I'll try to put together the stabilization bugs for this in the weekend.

[Comment 6 Tim Sammut (RETIRED) 2012-05-17 14:49:50 UTC]

Hans, @ruby, a friendly ping on this. Shall we move forward with stabilization? I suspect bug 348901 may have fixed/tracked any blockers? And we'll target 1.8.24, right? Thanks much.

[Comment 7 Hans de Graaff 2012-05-19 06:36:19 UTC]

(In reply to comment #6)
> Hans, @ruby, a friendly ping on this. Shall we move forward with
> stabilization? I suspect bug 348901 may have fixed/tracked any blockers? And
> we'll target 1.8.24, right? Thanks much.

I've just added arches to bug 411507 which asks for ruby 1.9 stabilization and includes rubygems 1.8.24.

[Comment 8 Sean Amoss (RETIRED) 2012-11-08 13:11:39 UTC]

Thanks, everyone.

GLSA vote: no.

[Comment 9 Tim Sammut (RETIRED) 2012-12-11 17:30:36 UTC]

Thanks, folks. GLSA Vote: no too, closing noglsa.

[Comment 10 GLSAMaker/CVETool Bot 2013-10-02 15:00:03 UTC]

CVE-2012-2126 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2126):
  RubyGems before 1.8.23 does not verify an SSL certificate, which allows
  remote attackers to modify a gem during installation via a man-in-the-middle
  attack.

CVE-2012-2125 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2125):
  RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes
  it easier for remote attackers to observe or modify a gem during
  installation via a man-in-the-middle attack.