sstephenson/ruby-build — pull request #504 by antifuchs (2014-02-08 01:44:02+00:00)
Title: Leaves rubies >= 2.0 vulnerable to CVE-2013-6393

As noted [in this comment](https://github.com/sstephenson/ruby-build/commit/63fc2c91b06b848714e5a0c540df0866b49c2bcf#commitcomment-5294849), the rubies >=2.0 vendor a vulnerable libyaml - 0.1.4.

The build scripts for them don't seem to make an effort to link a non-vulnerable libyaml, either. See here:

``` sh
$ env RBENV_VERSION=2.1.0 ruby -r yaml -e 'defined?(Psych) and puts Psych::LIBYAML_VERSION'
0.1.4
$ brew list libyaml | head -n1
/usr/local/Cellar/libyaml/0.1.5/include/yaml.h
$ rbenv install --version
ruby-build 20140204
$ rbenv install -f 2.1.0
...
$ env RBENV_VERSION=2.1.0 ruby -r yaml -e 'defined?(Psych) and puts Psych::LIBYAML_VERSION'
0.1.4
```

Weirdly enough, I can not reproduce this with 2.1.0 on a machine that has rbenv and ruby-build (at `20140204`) from homebrew, but *can* reproduce it on a machine that has both rbenv and ruby-build installed in `~/.rbenv` and the respective plugin folder.