[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CALPTtNUgr7_3=pnVO-5Lny735zBFsy=9nCiyotxNELUWk_KLUQ@mail.gmail.com>
Date: Tue, 4 Oct 2016 19:32:03 -0700
From: Reed Loden <reed@...dloden.com>
To: oss-security@...ts.openwall.com
Cc: steve@...lectiveidea.com, Assign a CVE Identifier <cve-assign@...re.org>
Subject: Re: Re: CVE request for code execution via gem name
collission in bundler (was Re: CVE Request)
I asked the Bundler team about this issue since this seemed to be lacking
details. They said that they attempted to fix this generic issue in Bundler
1.7 (see
http://bundler.io/blog/2014/08/14/bundler-may-install-gems-from-a-different-source-than-expected-cve-2013-0334.html),
and they were able to fix most of the issues.
However, there are some edge cases, which I think Steve is referring to.
Specifically, see https://github.com/bundler/bundler/issues/3671.
Additionally, see also https://github.com/bundler/bundler/pull/3696
(failing spec that shows the issue) and
https://github.com/bundler/bundler/pull/4714 (PR where the issue was fixed,
but only on Bundler 2.x branch).
The team was never able to remove all possibilities of namespace collisions
while keeping the existing lockfile format, which is why the fix was only
on Bundler 2.x.
~reed
On Tue, Oct 4, 2016 at 11:32 AM, <cve-assign@...re.org> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> > I'd like to request a CVE to track a security vulnerability found in
> > Bundler (bundler.io <http://bundler.io/>). Bundler allows the user to
> > specify sources from which Ruby gems are installed. If a secondary
> > source is specified, even if scoped to a specific gem, that source is
> > silently applied to all declared gems. This allows an attacker to
> > introduce arbitrary code into an application via gem name collision on
> > the secondary source, which will unexpectedly (and without warning)
> > take priority over the primary source.
>
> Use CVE-2016-7954.
>
> - --
> CVE Assignment Team
> M/S M300, 202 Burlington Road, Bedford, MA 01730 USA
> [ A PGP key is available for encrypted communications at
> http://cve.mitre.org/cve/request_id.html ]
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
>
> iQIcBAEBCAAGBQJX8/U7AAoJEHb/MwWLVhi2xrwP/RjNz+PRsrpnt6grFruRj6rH
> IvSdysqLU3/+gK2Q+1mXtdydmkn05PMLHrB58Os6hP+K5POjPnNjXsc+VfaoD83r
> S4wmDBs3H4l3XMrT+WHOqvZWsF74iDlTSFA35DNLFRW6Ad5IwPNuMcUBE8yqlMyK
> SQ6aU0BvwB7yygmeK6RBvDICsUthcyrTooXkmeDKe1EhRxgKXwdvFVeknKiCOneK
> hTMvNl6MyWU6BW3W0AelJG0mcndEu9Ai7DUf50mgCtuJCLay0wKLn8QrcYg7dWR8
> 17xFYh8v3soNMNrWBhyKcJUxWPz/YhNKbqjvXnk4Q1BIiEaBmYL4/Mw08dj+nKmy
> 2LTE+Kcx9vKHedo6lNT/Qxuug+S1czmbGESfygWACDpl2frB9YwVaU8MbFxZkfVj
> utU9+zrQBhRQXUw9ZMN83dJqqiC8956/IGWczI++rvp8cqrMETP91PueK23wE091
> SEzfASXty4n2HdD4AWwg0caECoDeUiDZP8UrQkkLDYu9Xlyeqw9C1vgiATTT3Uni
> bTFjnBhrohCXEh/uvoWJIqZZbO8DRQ0KWI6FlcDuDzubGrih0M4CM7KZ0bDRpwGC
> 9VGbDtdGK0XPOzzHvPUr+GDSjwZCJ0aFTaxlxwa+ol15mLKyBWCkLHd/8NYHvM5E
> is4rHDl4O1P83Wx0+Er0
> =RpXj
> -----END PGP SIGNATURE-----
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
