bundler 1.5.0

1 security vulnerability found in version 1.5.0

CVE-2013-0334 rubygem-bundler: 'bundle install' may install a gem from a source other than expected

medium severity CVE-2013-0334
medium severity CVE-2013-0334
Patched versions: >= 1.7.0

Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source. A flaw was found in the way Bundler handled gems available from multiple sources. An attacker with access to one of the sources could create a malicious gem with the same name, which they could then use to trick a user into installing, potentially resulting in execution of code from the attacker-supplied malicious gem.

No officially reported memory leakage issues detected.


This gem version does not have any officially reported memory leaked issues.

No license issues detected.


This gem version has a license in the gemspec.

This gem version is available.


This gem version has not been yanked and is still available for usage.