Gist
Monthly
Improper TLS certificate validation in the gist RubyGem before 6.1.0 allows an on-path attacker to intercept and alter every HTTPS request the tool makes to the GitHub API, because the http_connection helper in lib/gist.rb unconditionally sets OpenSSL::SSL::VERIFY_NONE. The affected component is the defunkt:gist gem (CPE cpe:2.3:a:defunkt:gist:*:*:*:*:*:*:*:*, all versions below 6.1.0), and a successful man-in-the-middle attacker can present any certificate to harvest OAuth access tokens and login credentials and to read or modify the victim's gists; the CVSS 4.0 base score of 9.1 reflects high confidentiality and integrity impact with no privileges or user interaction required. Exploitation requires the attacker to already hold a privileged on-path network position (AC:H/AT:P in both the CVSS 4.0 vector and the independent CVSS 3.1 assessment AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), no public exploit code has been identified at time of analysis, and there is no CISA KEV entry. A vendor fix is available in version 6.1.0.
Improper TLS certificate validation in the gist RubyGem before 6.1.0 allows an on-path attacker to intercept and alter every HTTPS request the tool makes to the GitHub API, because the http_connection helper in lib/gist.rb unconditionally sets OpenSSL::SSL::VERIFY_NONE. The affected component is the defunkt:gist gem (CPE cpe:2.3:a:defunkt:gist:*:*:*:*:*:*:*:*, all versions below 6.1.0), and a successful man-in-the-middle attacker can present any certificate to harvest OAuth access tokens and login credentials and to read or modify the victim's gists; the CVSS 4.0 base score of 9.1 reflects high confidentiality and integrity impact with no privileges or user interaction required. Exploitation requires the attacker to already hold a privileged on-path network position (AC:H/AT:P in both the CVSS 4.0 vector and the independent CVSS 3.1 assessment AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), no public exploit code has been identified at time of analysis, and there is no CISA KEV entry. A vendor fix is available in version 6.1.0.