Description
Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | rubygem-bundler +1 | 1.7.8-3.el7 | RHSA-2015:2180 |
| RHEL 7 | rubygem-thor +1 | 0.19.1-1.el7 | RHSA-2015:2180 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | rubygem-bundler +1 | 1.7.8-3.el7 | ELSA-2015-2180 |
| Oracle Linux 7 | rubygem-thor +1 | 0.19.1-1.el7 | ELSA-2015-2180 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | bundler | < 1.7.0 | 1.7.0 | GHSA-49jx-9cmc-xjxm |
Advisories 2
- RHSA-2015:2180 Red Hat Security Advisory: rubygem-bundler and rubygem-thor security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- ELSA-2015-2180 Moderate: rubygem-bundler and rubygem-thor security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 23, 2015
References
- GLSA-201609-02 vendor-advisory
- FEDORA-2014-11649 vendor-advisory
- FEDORA-2014-11630 vendor-advisory
- http://bundler.io/blog/2014/08/14/bundler-may-install-gems-from-a-different-source-than-expected-cve-2013-0334.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- FEDORA-2014-11677 vendor-advisory
- openSUSE-SU-2015:0628 vendor-advisory
- 70099 vdb-entry