Bug 1146335 (CVE-2013-0334)

Summary: CVE-2013-0334 rubygem-bundler: 'bundle install' may install a gem from a source other than expected
Product: [Other] Security Response Reporter: Murray McAllister <mmcallis>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abaron, aortega, apevec, ayoung, bdunne, besser82, bkabrda, bkearney, bleanhar, cbillett, ccoleman, chrisw, dajohnso, dallan, dclarizi, dmcphers, gkotton, gmccullo, hhorak, jdetiber, jfrey, jhardy, jialiu, jkeck, joelsmith, jokerman, jorton, jprause, jrafanie, jrusnack, jvlcek, katello-bugs, kseifried, lhh, lmeyer, lpeer, markmc, mburns, mmaslano, mmccomas, mmcgrath, obarenbo, rbryant, rhos-maint, sclewis, srevivo, s, tomckay, vondruch, xlecauch
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Bundler 1.7 Doc Type: Bug Fix
Doc Text:
A flaw was found in the way Bundler handled gems available from multiple sources. An attacker with access to one of the sources could create a malicious gem with the same name, which they could then use to trick a user into installing, potentially resulting in execution of code from the attacker-supplied malicious gem.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2016-11-03 21:12:07 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1146336, 1159442, 1165384, 1165385, 1210241    
Bug Blocks: 1146337, 1210268    

Description Murray McAllister 2014-09-25 03:28:32 UTC 
The 1.7.0 release of Bundler fixes an issue where a gem may be installed from a source other than expected, if the gem file had multiple, top-level source lines. This could potentially lead to a malicious gem file being installed.

From the upstream advisory:

""
Any Gemfile with multiple top-level source lines cannot reliably control the gem server that a particular gem is fetched from. As a result, Bundler might install the wrong gem if more than one source provides a gem with the same name.

This is especially possible in the case of Github's legacy gem server, hosted at gems.github.com. An attacker might create a malicious gem on Rubygems.org with the same name as a commonly-used Github gem. From that point forward, running bundle install might result in the malicious gem being used instead of the expected gem.

To mitigate this, the Bundler and Rubygems.org teams worked together to copy almost every gem hosted on gems.github.com to rubygems.org, reducing the number of gems that can be used for such an attack.
""

Note that upstream indicate that backporting is not practical.

External References:

http://bundler.io/blog/2014/08/14/bundler-may-install-gems-from-a-different-source-than-expected-cve-2013-0334.html
Comment 1 Murray McAllister 2014-09-25 03:30:09 UTC 
Created rubygem-bundler tracking bugs for this issue:

Affects: fedora-all [bug 1146336]
Comment 3 Fedora Update System 2014-10-12 05:02:39 UTC 
rubygem-bundler-1.7.3-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 4 Fedora Update System 2014-10-12 05:07:16 UTC 
rubygem-bundler-1.7.3-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2014-10-12 05:07:26 UTC 
rubygem-bundler-1.7.3-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 11 errata-xmlrpc 2015-11-19 03:51:47 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:2180 https://rhn.redhat.com/errata/RHSA-2015-2180.html