CVE-2012-2126
RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack.
- EPSS
- 1.4% chance of exploitation in the next 30 days; higher than 71% of CVEs (scores of 2026-10-31)
- CWE
- CWE-310
- Published
- Modified
- Record from
- the NVD, synced
Affected
- rubygems:rubygems
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-5mgj-mvv8-46mw | RubyGems | rubygems-update | <1.8.23 | 1.8.23 |