SB2015111901 - Red Hat update for rubygem-bundler and rubygem-thor
Published: November 19, 2015
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Insecure installation (CVE-ID: CVE-2013-0334)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to logic error within Bundler installation process, when handling gemfiles with multiple top-level sources. The application dies not control the installation source and may allow installing gem file from a different server from the list, if the server in question contains the gem file with the same name.
The attack could be launched using malicious gem file on a public repository, such as gems.github.com. A remote attacker can create a malicious gem file, which will be fetched and executed during installation.
Successful exploitation of the vulnerability may result in compromise of vulnerable system.
Remediation
Install update from vendor's website.