CVE-2013-0334

Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.

• CWE-20

• http://bundler.io/blog/2014/08/14/bundler-may-install-gems-from-a-different-source-than-expected-cve-2013-0334.htmlVendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140609.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140654.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140655.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-updates/2015-03/msg00092.htmlThird Party Advisory
• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlThird Party Advisory
• http://www.securityfocus.com/bid/70099Third Party Advisory, VDB Entry
• https://security.gentoo.org/glsa/201609-02Third Party Advisory
• http://bundler.io/blog/2014/08/14/bundler-may-install-gems-from-a-different-source-than-expected-cve-2013-0334.htmlVendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140609.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140654.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140655.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-updates/2015-03/msg00092.htmlThird Party Advisory
• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlThird Party Advisory
• http://www.securityfocus.com/bid/70099Third Party Advisory, VDB Entry
• https://security.gentoo.org/glsa/201609-02Third Party Advisory

Published

Oct 31, 2014

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-0328Cross-site scripting (XSS) vulnerability in Jenkins before 1…
• CVE-2013-0329Unspecified vulnerability in Jenkins before 1.502 and LTS be…
• CVE-2013-0330Unspecified vulnerability in Jenkins before 1.502 and LTS be…
• CVE-2013-0331Jenkins before 1.502 and LTS before 1.480.3 allows remote au…
• CVE-2013-0332Multiple directory traversal vulnerabilities in ZoneMinder 1…
• CVE-2013-0333lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.…
• CVE-2013-0335OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex…7.6
• CVE-2013-0336The ipapwd_chpwop function in daemons/ipa-slapi-plugins/ipa-…
• CVE-2013-0337The default configuration of nginx, possibly 1.3.13 and earl…
• CVE-2013-0338libxml2 2.9.0 and earlier allows context-dependent attackers…
• CVE-2013-0339libxml2 through 2.9.1 does not properly handle external enti…
• CVE-2013-0340expat before version 2.4.0 does not properly handle entities…