Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-abrtUpgrade rubygem-bsonUpgrade rubygem-mysql2Upgrade rubygem-pg-docUpgrade rubygem-mysql2-docUpgrade rubygem-mongo-docUpgrade rubygem-abrt-docUpgrade rubygem-mongoUpgrade rubygem-bson-docUpgrade rubygem-pg | May 4, 2022 | Sep 4, 2020 |
| Centos_linux | — | Upgrade rubygem-pg-debugsourceUpgrade rubygem-net-telnetUpgrade rubygem-io-consoleUpgrade rubygem-pg-debuginfoUpgrade rubygems-develUpgrade rubygem-abrtUpgrade rubygem-power_assertUpgrade rubygem-bson-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-irbUpgrade ruby-libsUpgrade rubyUpgrade rubygem-pg-docUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-minitestUpgrade rubygem-mongoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bson-docUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-rakeUpgrade ruby-develUpgrade rubygem-bson-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-bsonUpgrade rubygem-did_you_meanUpgrade rubygem-bigdecimalUpgrade rubygem-abrt-docUpgrade rubygem-json-debuginfoUpgrade rubygem-pgUpgrade rubygem-test-unitUpgrade rubygem-opensslUpgrade rubygem-mysql2-docUpgrade rubygem-rdocUpgrade rubygem-mongo-docUpgrade rubygem-psych-debuginfoUpgrade rubygem-jsonUpgrade rubygemsUpgrade ruby-libs-debuginfoUpgrade rubygem-psychUpgrade ruby-docUpgrade rubygem-bundlerUpgrade rubygem-xmlrpc | Jun 30, 2021 | Sep 4, 2020 |
| Freebsd | — | Upgrade gitlab-ce | Jan 10, 2021 | Jan 9, 2021 |
| Gentoo Linux | — | Upgrade dev-ruby/bundler. | Aug 12, 2024 | Sep 4, 2020 |
| Oracle_linux | — | Upgrade rubygem-test-unitUpgrade ruby-develUpgrade rubygem-power_assertUpgrade rubygem-mysql2-docUpgrade rubygem-net-telnetUpgrade ruby-docUpgrade rubygem-opensslUpgrade rubygem-irbUpgrade rubygem-minitestUpgrade rubygem-mongoUpgrade rubygem-abrtUpgrade rubyUpgrade rubygem-xmlrpcUpgrade rubygem-pgUpgrade rubygem-rdocUpgrade rubygemsUpgrade rubygem-bundlerUpgrade rubygems-develUpgrade rubygem-did_you_meanUpgrade rubygem-abrt-docUpgrade rubygem-io-consoleUpgrade rubygem-mongo-docUpgrade rubygem-bsonUpgrade rubygem-psychUpgrade rubygem-mysql2Upgrade rubygem-bigdecimalUpgrade rubygem-bson-docUpgrade rubygem-rakeUpgrade ruby-libsUpgrade rubygem-pg-docUpgrade rubygem-json | Jul 8, 2021 | May 23, 2018 |
| Redhat_linux | — | Upgrade rubygemsUpgrade rubygem-bson-debugsourceUpgrade rubygems-develUpgrade rubygem-json-debuginfoUpgrade rubygem-rdocUpgrade rubygem-mysql2-docUpgrade rubygem-minitestUpgrade rubygem-mongoUpgrade rubygem-pg-debuginfoUpgrade rubygem-xmlrpcUpgrade rubygem-io-consoleUpgrade ruby-libs-debuginfoUpgrade rubygem-net-telnetUpgrade rubygem-power_assertUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-console-debuginfoUpgrade rubygem-test-unitUpgrade ruby-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-bson-docUpgrade rubygem-bigdecimalUpgrade rubygem-pg-debugsourceUpgrade rubygem-irbNo solution existsUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pgUpgrade rubygem-bsonUpgrade rubygem-mysql2Upgrade rubygem-pg-docUpgrade rubyUpgrade rubygem-did_you_meanUpgrade rubygem-mongo-docUpgrade rubygem-psych-debuginfoUpgrade ruby-develUpgrade rubygem-abrtUpgrade ruby-docUpgrade rubygem-bson-debuginfoUpgrade rubygem-opensslUpgrade ruby-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-jsonUpgrade ruby-libsUpgrade rubygem-psychUpgrade rubygem-rake | Jun 30, 2021 | Sep 4, 2020 |
| Rocky_linux | — | Upgrade ruby-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-pgUpgrade rubygem-pg-debugsourceUpgrade ruby-develUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-opensslUpgrade rubygem-io-console-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubyUpgrade rubygem-json-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-jsonUpgrade ruby-debugsourceUpgrade rubygem-bsonUpgrade rubygem-psychUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mysql2Upgrade ruby-libsUpgrade rubygem-bson-debugsource | May 5, 2022 | Sep 4, 2020 |
| Suse | — | Upgrade ruby2.5-rubygem-bundlerUpgrade ruby2.5-rubygem-bundler-doc | Jun 13, 2020 | Jun 9, 2020 |
| Ubuntu | — | Upgrade bundler (Ubuntu Pro)Upgrade ruby-bundler (Ubuntu Pro) | Mar 22, 2023 | Sep 4, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 4, 2020 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub