[SUSE-SU-2015:0795-1] Security update for rubygem-bundler

The Rubygem Bundler was updated to version 1.7.0.

Bundler 1.7 is a security-only release to address CVE-2013-0334, a
vulnerability where a gem might be installed from an unintended source
server, particularly while using both rubygems.org and gems.github.com.

Upstream changes entry with more explanations:

Any Gemfile with multiple top-level source lines cannot reliably control
the gem server that a particular gem is fetched from. As a result, Bundler
might install the wrong gem if more than one source provides a gem with the
same name.

This is especially possible in the case of Github's legacy gem server,
hosted at gems.github.com. An attacker might create a malicious gem on
Rubygems.org with the same name as a commonly-used Github gem. From that
point forward, running bundle install might result in the malicious gem
being used instead of the expected gem.

To mitigate this, the Bundler and Rubygems.org teams worked together to
copy almost every gem hosted on gems.github.com to rubygems.org, reducing
the number of gems that can be used for such an attack.

Resolution:

To resolve this issue, upgrade to Bundler 1.7 by running gem install
bundler. The next time you run bundle install for any Gemfile that contains
multiple sources, each gem available from multiple sources will print a
warning.

For every warning printed, edit the Gemfile to either specify a :source
option for that gem, or move the gem line into a block that is passed to a
source method call.

For detailed information about the changes to how sources are handled in
Bundler version 1.7, see the release announcement.

Security Issues:

* CVE-2013-0334
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0334>