CVE-2013-0334

描述

Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.

如何修補 CVE-2013-0334

要修補 CVE-2013-0334,請將受影響套件升級到下列已修補版本。

• RubyGems/bundler—升級至 1.7.0 或更新版本

CVE-2013-0334 正在被利用嗎?

低 — EPSS 為 3.9%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 1.7.0

參考連結(11)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2013-0334
• PATCHgithub.com/rubygems/bundler
• WEBbundler.io/blog/2014/08/14/bundler-may-install-gems-from-a-different-source-than-expected-cve-2013-0334.html
• WEBlists.fedoraproject.org/pipermail/package-announce/2014-October/140609.html