CVE-2012-2125
The MITRE CVE dictionary describes this issue as:
RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack.
Find out more about CVE-2012-2125 from the MITRE CVE dictionary dictionary and NIST NVD.
Statement
The Red Hat Security Response Team has rated this issue as having moderate security impact in CloudForms 1.1. This issue is not currently planned to be addressed in future updates.
CVSS v2 metrics
| Base Score | 4 |
|---|---|
| Base Metrics | AV:N/AC:H/Au:N/C:P/I:P/A:N |
| Access Vector | Network |
| Access Complexity | High |
| Authentication | None |
| Confidentiality Impact | Partial |
| Integrity Impact | Partial |
| Availability Impact | None |
Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).
Red Hat Security Errata
| Platform | Errata | Release Date |
|---|---|---|
| RHOSE Client 1.2 (rubygems) | RHSA-2013:1203 | 2013-09-04 |
| Red Hat MRG Grid for RHEL 6 Server v.2 (rubygems) | RHSA-2013:1852 | 2013-12-17 |
| Red Hat MRG Grid Execute Node for RHEL 6 ComputeNode v.2 (rubygems) | RHSA-2013:1852 | 2013-12-17 |
| Red Hat Enterprise Linux 6 (rubygems) | RHSA-2013:1441 | 2013-10-17 |
Affected Packages State
| Platform | Package | State |
|---|---|---|
| Red Hat Subscription Asset Manager 1 | rubygems | Will not fix |
| Red Hat CloudForms Tools 1 | rubygems | Will not fix |
CVE description copyright © 2017, The MITRE Corporation