Red Hat Security AdvisoryRHSA-2015:2180
rubygem-bundler and rubygem-thor security, bug fix, and enhancement update
Released 2015-11-19 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) rubygem-bundler-1.7.8-3.el7, rubygem-thor-0.19.1-1.el7
- Red Hat Enterprise Linux Client Optional (v. 7) rubygem-bundler-doc-1.7.8-3.el7, rubygem-thor-doc-0.19.1-1.el7
- Red Hat Enterprise Linux ComputeNode (v. 7) rubygem-bundler-1.7.8-3.el7, rubygem-thor-0.19.1-1.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) rubygem-bundler-doc-1.7.8-3.el7, rubygem-thor-doc-0.19.1-1.el7
- Red Hat Enterprise Linux Server (v. 7) rubygem-bundler-1.7.8-3.el7, rubygem-thor-0.19.1-1.el7
- Red Hat Enterprise Linux Server Optional (v. 7) rubygem-bundler-doc-1.7.8-3.el7, rubygem-thor-doc-0.19.1-1.el7
- Red Hat Enterprise Linux Workstation (v. 7) rubygem-bundler-1.7.8-3.el7, rubygem-thor-0.19.1-1.el7
- Red Hat Enterprise Linux Workstation Optional (v. 7) rubygem-bundler-doc-1.7.8-3.el7, rubygem-thor-doc-0.19.1-1.el7
Fixes 1 record
Priority LOW 30
Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.04303 · Published 2014-10-31 · Partial fix · 1.7.0 CWE-20
