CVE-2012-2125

CVE-2012-2125 describes a vulnerability in RubyGems versions prior to 1.8.23, affecting products like Canonical and Red Hat OpenShift and Ubuntu Linux. This flaw allows RubyGems to downgrade HTTPS connections to HTTP, enabling remote attackers to conduct man-in-the-middle attacks to observe or modify gems during installation. With a CVSS score of 5.8, this medium-severity vulnerability has a network attack vector and medium attack complexity, potentially leading to partial confidentiality and integrity compromise. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.