{"affected":[],"aliases":[],"details":"\nThe Rubygem Bundler was updated to version 1.7.0.\n\nBundler 1.7 is a security-only release to address CVE-2013-0334, a \nvulnerability where a gem might be installed from an unintended source \nserver, particularly while using both rubygems.org and gems.github.com.\n\nUpstream changes entry with more explanations:\n\nAny Gemfile with multiple top-level source lines cannot reliably control \nthe gem server that a particular gem is fetched from. As a result, Bundler \nmight install the wrong gem if more than one source provides a gem with the \nsame name.\n\nThis is especially possible in the case of Github's legacy gem server, \nhosted at gems.github.com. An attacker might create a malicious gem on \nRubygems.org with the same name as a commonly-used Github gem. From that \npoint forward, running bundle install might result in the malicious gem \nbeing used instead of the expected gem.\n\nTo mitigate this, the Bundler and Rubygems.org teams worked together to \ncopy almost every gem hosted on gems.github.com to rubygems.org, reducing \nthe number of gems that can be used for such an attack.\n\nResolution:\n\nTo resolve this issue, upgrade to Bundler 1.7 by running gem install \nbundler. The next time you run bundle install for any Gemfile that contains \nmultiple sources, each gem available from multiple sources will print a \nwarning.\n\nFor every warning printed, edit the Gemfile to either specify a :source \noption for that gem, or move the gem line into a block that is passed to a \nsource method call.\n\nFor detailed information about the changes to how sources are handled in \nBundler version 1.7, see the release announcement.\n\nSecurity Issues:\n\n    * CVE-2013-0334\n      <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0334>\n\n","id":"SUSE-SU-2015:0795-1","modified":"2015-03-11T16:15:22Z","published":"2015-03-11T16:15:22Z","references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150795-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/898205"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2013-0334"}],"related":["CVE-2013-0334"],"summary":"Security update for rubygem-bundler","upstream":["CVE-2013-0334"]}