RubySec

Providing security resources for the Ruby community

CVE-2013-0334 (bundler): CVE-2013-0334 rubygem-bundler: 'bundle install' may install a gem from a source other than expected

ADVISORIES

GEM

bundler

SEVERITY

CVSS v2.0: 5.0 (Medium)

PATCHED VERSIONS

  • >= 1.7.0

DESCRIPTION

Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source. A flaw was found in the way Bundler handled gems available from multiple sources. An attacker with access to one of the sources could create a malicious gem with the same name, which they could then use to trick a user into installing, potentially resulting in execution of code from the attacker-supplied malicious gem.