Bug 2545734 (CVE-2026-105221)

Summary: CVE-2026-105221 gist: gist: Traffic interception and credential theft via improper TLS certificate validation
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in gist. The utility completely disables Transport Layer Security (TLS) certificate verification when establishing HTTPS connections. An on-path attacker can exploit this flaw by presenting an arbitrary certificate to intercept, read, and manipulate network traffic. This can lead to information disclosure, including the theft of sensitive authentication tokens and credentials, and allow unauthorized modification of user data.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2546280    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-04 22:51:27 UTC 
The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http_connection in lib/gist.rb sets VERIFY_NONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens and login credentials to read and modify the victim's gists.