ID CVE-2014-0036
Summary The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors.
References
Vulnerable Configurations
  • cpe:2.3:a:amos_benari:rbovirt:0.0.1:*:*:*:*:ruby:*:*
    cpe:2.3:a:amos_benari:rbovirt:0.0.1:*:*:*:*:ruby:*:*
  • cpe:2.3:a:amos_benari:rbovirt:0.0.2:*:*:*:*:ruby:*:*
    cpe:2.3:a:amos_benari:rbovirt:0.0.2:*:*:*:*:ruby:*:*
  • cpe:2.3:a:amos_benari:rbovirt:0.0.3:*:*:*:*:ruby:*:*
    cpe:2.3:a:amos_benari:rbovirt:0.0.3:*:*:*:*:ruby:*:*
  • cpe:2.3:a:amos_benari:rbovirt:0.0.4:*:*:*:*:ruby:*:*
    cpe:2.3:a:amos_benari:rbovirt:0.0.4:*:*:*:*:ruby:*:*
  • cpe:2.3:a:amos_benari:rbovirt:0.0.5:*:*:*:*:ruby:*:*
    cpe:2.3:a:amos_benari:rbovirt:0.0.5:*:*:*:*:ruby:*:*
  • cpe:2.3:a:amos_benari:rbovirt:0.0.6:*:*:*:*:ruby:*:*
    cpe:2.3:a:amos_benari:rbovirt:0.0.6:*:*:*:*:ruby:*:*
  • cpe:2.3:a:amos_benari:rbovirt:0.0.7:*:*:*:*:ruby:*:*
    cpe:2.3:a:amos_benari:rbovirt:0.0.7:*:*:*:*:ruby:*:*
  • cpe:2.3:a:amos_benari:rbovirt:0.0.8:*:*:*:*:ruby:*:*
    cpe:2.3:a:amos_benari:rbovirt:0.0.8:*:*:*:*:ruby:*:*
  • cpe:2.3:a:amos_benari:rbovirt:0.0.9:*:*:*:*:ruby:*:*
    cpe:2.3:a:amos_benari:rbovirt:0.0.9:*:*:*:*:ruby:*:*
  • cpe:2.3:a:amos_benari:rbovirt:0.0.10:*:*:*:*:ruby:*:*
    cpe:2.3:a:amos_benari:rbovirt:0.0.10:*:*:*:*:ruby:*:*
  • cpe:2.3:a:amos_benari:rbovirt:0.0.11:*:*:*:*:ruby:*:*
    cpe:2.3:a:amos_benari:rbovirt:0.0.11:*:*:*:*:ruby:*:*
  • cpe:2.3:a:amos_benari:rbovirt:0.0.12:*:*:*:*:ruby:*:*
    cpe:2.3:a:amos_benari:rbovirt:0.0.12:*:*:*:*:ruby:*:*
  • cpe:2.3:a:amos_benari:rbovirt:0.0.13:*:*:*:*:ruby:*:*
    cpe:2.3:a:amos_benari:rbovirt:0.0.13:*:*:*:*:ruby:*:*
  • cpe:2.3:a:amos_benari:rbovirt:0.0.14:*:*:*:*:ruby:*:*
    cpe:2.3:a:amos_benari:rbovirt:0.0.14:*:*:*:*:ruby:*:*
  • cpe:2.3:a:amos_benari:rbovirt:0.0.15:*:*:*:*:ruby:*:*
    cpe:2.3:a:amos_benari:rbovirt:0.0.15:*:*:*:*:ruby:*:*
  • cpe:2.3:a:amos_benari:rbovirt:0.0.16:*:*:*:*:ruby:*:*
    cpe:2.3:a:amos_benari:rbovirt:0.0.16:*:*:*:*:ruby:*:*
  • cpe:2.3:a:amos_benari:rbovirt:0.0.17:*:*:*:*:ruby:*:*
    cpe:2.3:a:amos_benari:rbovirt:0.0.17:*:*:*:*:ruby:*:*
  • cpe:2.3:a:amos_benari:rbovirt:0.0.18:*:*:*:*:ruby:*:*
    cpe:2.3:a:amos_benari:rbovirt:0.0.18:*:*:*:*:ruby:*:*
  • cpe:2.3:a:amos_benari:rbovirt:0.0.19:*:*:*:*:ruby:*:*
    cpe:2.3:a:amos_benari:rbovirt:0.0.19:*:*:*:*:ruby:*:*
  • cpe:2.3:a:amos_benari:rbovirt:0.0.20:*:*:*:*:ruby:*:*
    cpe:2.3:a:amos_benari:rbovirt:0.0.20:*:*:*:*:ruby:*:*
  • cpe:2.3:a:amos_benari:rbovirt:0.0.21:*:*:*:*:ruby:*:*
    cpe:2.3:a:amos_benari:rbovirt:0.0.21:*:*:*:*:ruby:*:*
  • cpe:2.3:a:amos_benari:rbovirt:0.0.22:*:*:*:*:ruby:*:*
    cpe:2.3:a:amos_benari:rbovirt:0.0.22:*:*:*:*:ruby:*:*
  • cpe:2.3:a:amos_benari:rbovirt:0.0.23:*:*:*:*:ruby:*:*
    cpe:2.3:a:amos_benari:rbovirt:0.0.23:*:*:*:*:ruby:*:*
CVSS
Base: 6.8 (as of 18-04-2014 - 13:48)
Impact:
Exploitability:
CWE CWE-310
CAPEC
  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:M/Au:N/C:P/I:P/A:P
refmap via4
confirm https://bugzilla.redhat.com/show_bug.cgi?id=1058595
fedora
  • FEDORA-2014-3526
  • FEDORA-2014-3573
mlist [oss-security] 20140306 CVE-2014-0036 rubygem-rbovirt: unsafe use of rest-client
Last major update 18-04-2014 - 13:48
Published 17-04-2014 - 14:55
Last modified 18-04-2014 - 13:48
Back to Top