Index: devel/ruby-gems/Makefile =================================================================== --- devel/ruby-gems/Makefile +++ devel/ruby-gems/Makefile @@ -2,7 +2,7 @@ # $FreeBSD$ PORTNAME= gems -PORTVERSION= 2.4.6 +PORTVERSION= 2.4.7 CATEGORIES= devel ruby MASTER_SITES= http://production.cf.rubygems.org/rubygems/ PKGNAMEPREFIX= ${RUBY_PKGNAMEPREFIX} Index: devel/ruby-gems/distinfo =================================================================== --- devel/ruby-gems/distinfo +++ devel/ruby-gems/distinfo @@ -1,2 +1,2 @@ -SHA256 (ruby/rubygems-2.4.6.tgz) = 76d3f3b10aa824d23a511f098ab777c6473b98ffa733f7be4222408897b68db9 -SIZE (ruby/rubygems-2.4.6.tgz) = 447588 +SHA256 (ruby/rubygems-2.4.7.tgz) = 62fabf8b1a3009cf65f0fc9c2bad68754aa229780d7139232c4ca9f4708ad6ec +SIZE (ruby/rubygems-2.4.7.tgz) = 447941 Index: security/vuxml/vuln.xml =================================================================== --- security/vuxml/vuln.xml +++ security/vuxml/vuln.xml @@ -57,6 +57,48 @@ --> + + rubygems -- request hijacking vulnerability + + + ruby20-gems + 2.4.7 + + + ruby21-gems + 2.4.7 + + + ruby22-gems + 2.4.7 + + + + +

Jonathan Claudius reports:

+
RubyGems provides the ability of a domain to direct clients to a + separate host that is used to fetch gems and make API calls against. + This mechanism is implemented via DNS, specificly a SRV record + _rubygems._tcp under the original requested domain.
+
RubyGems did not validate the hostname returned in the SRV record + before sending requests to it. This left clients open to a DNS + hijack attack, whereby an attacker could return a SRV of their + choosing and get the client to use it.
+

+ + + + ports/200264 + CVE-2015-3900 + http://blog.rubygems.org/2015/05/14/CVE-2015-3900.html + + + 2015-05-14 + 2015-05-17 + + + qemu -- possible VM escape and code execution ("VENOM")