oss-security - [CVE-2013-0334] Ruby dependency manager Bundler may install gems from a different source than expected

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 24 Sep 2014 21:58:22 +0900
From: André Arko <andre@...o.net>
To: oss-security@...ts.openwall.com
Subject: [CVE-2013-0334] Ruby dependency manager Bundler may install gems from a different source than expected

Bundler 1.7 is a security-only release to address CVE-2013-0334, a vulnerability where a gem might be installed from an unintended source server, particularly while using both rubygems.org and gems.github.com.

Versions Affected: All versions < 1.7.0
Not Affected: Any Gemfile with one or zero sources

Fixed Versions: 1.7.0
Releases: 1.7.0 (2014-09-14)

This announcement is also posted on the Bundler website, at http://bundler.io/blog/2014/08/14/bundler-may-install-gems-from-a-different-source-than-expected-cve-2013-0334.html.

Impact:

Any Gemfile with multiple top-level `source` lines cannot reliably control the gem server that a particular gem is fetched from. As a result, Bundler might install the wrong gem if more than one source provides a gem with the same name.

This is especially possible in the case of Github's legacy gem server, hosted at gems.github.com. An attacker might create a malicious gem on Rubygems.org with the same name as a commonly-used Github gem. From that point forward, running `bundle install` might result in the malicious gem being used instead of the expected gem.

To mitigate this, the Bundler and Rubygems.org teams worked together to copy almost every gem hosted on gems.github.com to rubygems.org, reducing the number of gems that can be used for such an attack.

Resolution:

To resolve this issue, upgrade to Bundler 1.7 by running `gem install bundler`. The next time you run `bundle install` for any Gemfile that contains multiple sources, each gem available from multiple sources will print a warning.

For every warning printed, edit the Gemfile to either specify a `:source` option for that gem, or move the `gem` line into a block that is passed to a `source` method call.

For detailed information about the changes to how sources are handled in Bundler version 1.7, see http://bundler.io/v1.7/whats_new.html

Workarounds:

If you are unable to upgrade to Bundler 1.7, it is possible to work around the issue by removing all but one `source` line from your Gemfile. Gems from other sources must be installed via the `:git` option, which is not susceptible to this issue, or unpacked into the application repository and used via the `:path`option.

Unfortunately, backporting a fix for this issue proved impractical, as previous versions of Bundler lacked the ability to distinguish between gem servers.

Credits:

Thanks to Andreas Loupasakis and Fotos Georgiadis for reporting this issue, James Tucker, Tony Arcieri, Eric Hodel, Michael Koziarski, and Kurt Seifried for assistance with the eventual solution, and David Radcliffe for importing legacy Github gems into Rubygems.org.

André Arko (@indirect), Tim Moore (@tmoore), and the Bundler team (@bundlerio)
team@...dler.io

Download attachment "signature.asc" of type "application/pgp-signature" (794 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.