CVE-2013-0334 Bundler may install gems from a different source than expected
Attackers can install malicious gems by exploiting multiple source configurations in Bundler, leading to arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-0334?
CVE-2013-0334 is a medium-severity vulnerability in Fedoraproject Fedora, published on 31 Oct 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.
Weakness: CWE-20
Which versions are affected by CVE-2013-0334?
2 open source packages ship an affected version, including bundler. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
bundler RubyGems | All versions | 1.7.0 |
bundler RubyGems | All versions | 1.7.0 |
Linux distribution packages (16)
rubygem-bundler Red Hat:enterprise_linux:7::client | All versions | 0:1.7.8-3.el7 |
rubygem-bundler-doc Red Hat:enterprise_linux:7::client | All versions | 0:1.7.8-3.el7 |
rubygem-thor Red Hat:enterprise_linux:7::client | All versions | 0:0.19.1-1.el7 |
rubygem-thor-doc Red Hat:enterprise_linux:7::client | All versions | 0:0.19.1-1.el7 |
rubygem-bundler Red Hat:enterprise_linux:7::computenode | All versions | 0:1.7.8-3.el7 |
rubygem-bundler-doc Red Hat:enterprise_linux:7::computenode | All versions | 0:1.7.8-3.el7 |
rubygem-thor Red Hat:enterprise_linux:7::computenode | All versions | 0:0.19.1-1.el7 |
rubygem-thor-doc Red Hat:enterprise_linux:7::computenode | All versions | 0:0.19.1-1.el7 |
rubygem-bundler Red Hat:enterprise_linux:7::server | All versions | 0:1.7.8-3.el7 |
rubygem-bundler-doc Red Hat:enterprise_linux:7::server | All versions | 0:1.7.8-3.el7 |
rubygem-thor Red Hat:enterprise_linux:7::server | All versions | 0:0.19.1-1.el7 |
rubygem-thor-doc Red Hat:enterprise_linux:7::server | All versions | 0:0.19.1-1.el7 |
rubygem-bundler Red Hat:enterprise_linux:7::workstation | All versions | 0:1.7.8-3.el7 |
rubygem-bundler-doc Red Hat:enterprise_linux:7::workstation | All versions | 0:1.7.8-3.el7 |
rubygem-thor Red Hat:enterprise_linux:7::workstation | All versions | 0:0.19.1-1.el7 |
rubygem-thor-doc Red Hat:enterprise_linux:7::workstation | All versions | 0:0.19.1-1.el7 |
Products include Bundler Bundler, Fedoraproject Fedora, Opensuse Opensuse.
How do I fix CVE-2013-0334?
Upgrade bundler to 1.7.0 or later.
Is CVE-2013-0334 being exploited?
There is no known exploitation of CVE-2013-0334 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as GHSA-49jx-9cmc-xjxm, RHSA-2015:2180, SUSE-SU-2015:0795-1.