Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mongoUpgrade rubygem-pgUpgrade rubygem-bson-docUpgrade rubygem-abrt-docUpgrade rubygem-mongo-docUpgrade rubygem-mysql2-docUpgrade rubygem-bsonUpgrade rubygem-mysql2Upgrade rubygem-abrtUpgrade rubygem-pg-doc | May 4, 2022 | Sep 4, 2020 |
| Centos_linux | — | Upgrade rubygem-psychUpgrade rubygemsUpgrade ruby-libs-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-pgUpgrade rubygem-mongo-docUpgrade ruby-docUpgrade rubygem-psych-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-rdocUpgrade rubygem-jsonUpgrade rubygem-bsonUpgrade rubygem-abrt-docUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-docUpgrade rubygem-opensslUpgrade rubygem-json-debuginfoUpgrade rubygem-xmlrpcUpgrade rubygem-test-unitUpgrade rubygem-mysql2Upgrade rubygem-bson-debuginfoUpgrade rubygem-net-telnetUpgrade rubygem-bson-docUpgrade rubyUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-pg-docUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-irbUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-power_assertUpgrade rubygem-minitestUpgrade rubygem-io-console-debuginfoUpgrade rubygem-rakeUpgrade ruby-develUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mongoUpgrade rubygem-bson-debugsourceUpgrade rubygems-develUpgrade rubygem-abrt | Jun 30, 2021 | Sep 4, 2020 |
| Freebsd | — | Upgrade gitlab-ce | Jan 10, 2021 | Jan 9, 2021 |
| Gentoo Linux | — | Upgrade dev-ruby/bundler. | Aug 12, 2024 | Sep 4, 2020 |
| Oracle_linux | — | Upgrade rubygem-rdocUpgrade rubyUpgrade rubygem-test-unitUpgrade rubygem-irbUpgrade rubygem-minitestUpgrade rubygem-bundlerUpgrade rubygem-opensslUpgrade rubygem-abrtUpgrade rubygemsUpgrade rubygem-mysql2-docUpgrade ruby-develUpgrade rubygem-pgUpgrade rubygem-net-telnetUpgrade rubygem-xmlrpcUpgrade rubygem-mongoUpgrade ruby-docUpgrade rubygems-develUpgrade rubygem-power_assertUpgrade rubygem-rakeUpgrade rubygem-bsonUpgrade rubygem-psychUpgrade rubygem-mysql2Upgrade rubygem-pg-docUpgrade rubygem-mongo-docUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade rubygem-bson-docUpgrade rubygem-bigdecimalUpgrade rubygem-abrt-docUpgrade rubygem-did_you_mean | Jul 8, 2021 | May 23, 2018 |
| Redhat_linux | — | Upgrade rubygem-bson-docUpgrade rubygem-rdocUpgrade ruby-libs-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-abrt-docUpgrade rubygemsUpgrade rubygem-json-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-xmlrpcUpgrade ruby-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-mongoUpgrade rubygem-test-unitUpgrade rubygem-minitestUpgrade rubygem-mysql2-docUpgrade rubygems-develUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-net-telnetUpgrade rubygem-io-consoleUpgrade rubygem-psychUpgrade rubygem-psych-debuginfoUpgrade rubygem-rakeUpgrade rubygem-bson-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-bundlerUpgrade ruby-libsUpgrade rubygem-jsonUpgrade rubygem-mongo-docUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pgUpgrade rubygem-opensslUpgrade ruby-docUpgrade ruby-develUpgrade rubygem-irbUpgrade rubyUpgrade rubygem-mysql2No solution existsUpgrade rubygem-bsonUpgrade rubygem-abrtUpgrade rubygem-pg-docUpgrade rubygem-did_you_meanUpgrade rubygem-pg-debugsourceUpgrade rubygem-openssl-debuginfo | Jun 30, 2021 | Sep 4, 2020 |
| Rocky_linux | — | Upgrade rubygem-bson-debugsourceUpgrade ruby-libsUpgrade rubygem-mysql2Upgrade rubygem-openssl-debuginfoUpgrade rubygem-io-consoleUpgrade ruby-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-jsonUpgrade rubygem-json-debuginfoUpgrade rubygem-psychUpgrade rubygem-bsonUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bigdecimalUpgrade rubygem-bson-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby-develUpgrade ruby-libs-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-opensslUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubyUpgrade rubygem-pg | May 5, 2022 | Sep 4, 2020 |
| Suse | — | Upgrade ruby2.5-rubygem-bundlerUpgrade ruby2.5-rubygem-bundler-doc | Jun 13, 2020 | Jun 9, 2020 |
| Ubuntu | — | Upgrade ruby-bundler (Ubuntu Pro)Upgrade bundler (Ubuntu Pro) | Mar 22, 2023 | Sep 4, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 4, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub