Security update for rubygem-bundler SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:0795-1 Final 1 1 2015-03-11T16:15:22Z current 2015-03-11T16:15:22Z 2015-03-11T16:15:22Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for rubygem-bundler The Rubygem Bundler was updated to version 1.7.0. Bundler 1.7 is a security-only release to address CVE-2013-0334, a vulnerability where a gem might be installed from an unintended source server, particularly while using both rubygems.org and gems.github.com. Upstream changes entry with more explanations: Any Gemfile with multiple top-level source lines cannot reliably control the gem server that a particular gem is fetched from. As a result, Bundler might install the wrong gem if more than one source provides a gem with the same name. This is especially possible in the case of Github's legacy gem server, hosted at gems.github.com. An attacker might create a malicious gem on Rubygems.org with the same name as a commonly-used Github gem. From that point forward, running bundle install might result in the malicious gem being used instead of the expected gem. To mitigate this, the Bundler and Rubygems.org teams worked together to copy almost every gem hosted on gems.github.com to rubygems.org, reducing the number of gems that can be used for such an attack. Resolution: To resolve this issue, upgrade to Bundler 1.7 by running gem install bundler. The next time you run bundle install for any Gemfile that contains multiple sources, each gem available from multiple sources will print a warning. For every warning printed, edit the Gemfile to either specify a :source option for that gem, or move the gem line into a block that is passed to a source method call. For detailed information about the changes to how sources are handled in Bundler version 1.7, see the release announcement. Security Issues: * CVE-2013-0334 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0334> The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp3-rubygem-bundler,sleclo40sp3-rubygem-bundler,slehasp3-rubygem-bundler,sleslms13-rubygem-bundler,slestso13-rubygem-bundler,slestso13-rubygem-bundler19,slewyst13-rubygem-bundler Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20150795-1/ Link for SUSE-SU-2015:0795-1 https://lists.suse.com/pipermail/sle-security-updates/2015-April/001365.html E-Mail link for SUSE-SU-2015:0795-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/898205 SUSE Bug 898205 https://www.suse.com/security/cve/CVE-2013-0334/ SUSE CVE CVE-2013-0334 page SUSE Lifecycle Management Server 1.3 SUSE Linux Enterprise High Availability Extension 11 SP3 SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE OpenStack Cloud 4 SUSE Studio Onsite 1.3 SUSE WebYast 1.3 rubygem-bundler-1.7.0-0.7.1 rubygem-bundler19-1.7.0-0.12.1 rubygem-bundler-1.7.0-0.7.1 as a component of SUSE Lifecycle Management Server 1.3 rubygem-bundler-1.7.0-0.7.1 as a component of SUSE Linux Enterprise High Availability Extension 11 SP3 rubygem-bundler-1.7.0-0.7.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP3 rubygem-bundler-1.7.0-0.7.1 as a component of SUSE OpenStack Cloud 4 rubygem-bundler-1.7.0-0.7.1 as a component of SUSE Studio Onsite 1.3 rubygem-bundler19-1.7.0-0.12.1 as a component of SUSE Studio Onsite 1.3 rubygem-bundler-1.7.0-0.7.1 as a component of SUSE WebYast 1.3 Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source. CVE-2013-0334 SUSE Lifecycle Management Server 1.3:rubygem-bundler-1.7.0-0.7.1 SUSE Linux Enterprise High Availability Extension 11 SP3:rubygem-bundler-1.7.0-0.7.1 SUSE Linux Enterprise Software Development Kit 11 SP3:rubygem-bundler-1.7.0-0.7.1 SUSE OpenStack Cloud 4:rubygem-bundler-1.7.0-0.7.1 SUSE Studio Onsite 1.3:rubygem-bundler-1.7.0-0.7.1 SUSE Studio Onsite 1.3:rubygem-bundler19-1.7.0-0.12.1 SUSE WebYast 1.3:rubygem-bundler-1.7.0-0.7.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150795-1/ https://www.suse.com/security/cve/CVE-2013-0334.html CVE-2013-0334 https://bugzilla.suse.com/898205 SUSE Bug 898205 https://bugzilla.suse.com/922719 SUSE Bug 922719