PulseLinuxLINUX UPDATE INTELLIGENCE
CVE Database›Document archive›CVE-2013-0334

CVE-2013-0334

rubygem-bundler: 'bundle install' may install a gem from a source other than expected

Loading…

Severity

Moderate

Red Hat Product Security

5.1

CVSS 2.0

Review impact separately from score.

Published · August 14, 2014

Updated · June 27, 2026

Description

A flaw was found in the way Bundler handled gems available from multiple sources. An attacker with access to one of the sources could create a malicious gem with the same name, which they could then use to trick a user into installing, potentially resulting in execution of code from the attacker-supplied malicious gem.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 2.0 · 5.1
AV:N/AC:H/Au:N/C:P/I:P/A:P

CWE-345 · Insufficient Verification of Data Authenticity