Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every "Dependency Confusion" issue in every product.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-minitestUpgrade rubygem-opensslUpgrade rubygem-mongoUpgrade rubygem-mysql2-docUpgrade rubygem-abrtUpgrade rubyUpgrade rubygem-mongo-docUpgrade rubygemsUpgrade ruby-default-gemsUpgrade rubygem-bundler-docUpgrade rubygem-rdocUpgrade rubygem-irbUpgrade rubygem-bundlerUpgrade rubygem-pgUpgrade ruby-docUpgrade ruby-develUpgrade rubygem-xmlrpcUpgrade rubygem-power_assertUpgrade rubygem-test-unitUpgrade rubygem-net-telnetUpgrade rubygem-mysql2Upgrade rubygem-bsonUpgrade ruby-libsUpgrade rubygem-pg-docUpgrade rubygem-io-consoleUpgrade rubygem-psychUpgrade rubygem-jsonUpgrade rubygem-bson-docUpgrade rubygem-did_you_meanUpgrade ruby-irbUpgrade rubygem-bigdecimalUpgrade rubygem-abrt-docUpgrade rubygem-rakeUpgrade rubygems-devel | May 4, 2022 | Apr 29, 2021 |
| Alpine Linux | — | Upgrade ruby-bundler | Mar 21, 2024 | Apr 29, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Apr 29, 2021 |
| Centos_linux | — | Upgrade rubygem-bundler-docUpgrade rubygem-rakeUpgrade rubygem-abrt-docUpgrade rubygem-bson-docUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-json-debuginfoUpgrade ruby-irbUpgrade rubygem-minitestUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-xmlrpcUpgrade rubygem-test-unitUpgrade rubygems-develUpgrade rubygem-rdocUpgrade ruby-debuginfoUpgrade rubygem-net-telnetUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygemsUpgrade ruby-develUpgrade rubygem-pg-debugsourceUpgrade ruby-docUpgrade rubygem-pg-debuginfoUpgrade rubygem-bsonUpgrade ruby-libsUpgrade rubygem-pgUpgrade ruby-libs-debuginfoUpgrade rubygem-jsonUpgrade rubygem-abrtUpgrade rubyUpgrade rubygem-mongoUpgrade rubygem-did_you_meanUpgrade ruby-default-gemsUpgrade rubygem-psychUpgrade rubygem-pg-docUpgrade rubygem-mysql2Upgrade ruby-debugsourceUpgrade rubygem-mongo-docUpgrade rubygem-power_assertUpgrade rubygem-bson-debuginfoUpgrade rubygem-irbUpgrade rubygem-opensslUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-psych-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bundler | Aug 6, 2021 | Apr 29, 2021 |
| Debian | — | Upgrade rubygems | Jul 30, 2024 | Apr 29, 2021 |
| Gentoo Linux | — | Upgrade dev-ruby/bundler. | Aug 12, 2024 | Apr 29, 2021 |
| Oracle_linux | — | Upgrade rubygem-mysql2Upgrade rubygem-power_assertUpgrade rubygem-bigdecimalUpgrade rubygem-bundlerUpgrade ruby-libsUpgrade rubygem-pg-docUpgrade rubygem-abrtUpgrade rubygem-bson-docUpgrade rubygem-jsonUpgrade ruby-develUpgrade rubygem-io-consoleUpgrade rubyUpgrade rubygem-rakeUpgrade ruby-irbUpgrade rubygem-minitestUpgrade rubygem-mongoUpgrade rubygem-net-telnetUpgrade rubygem-irbUpgrade rubygem-abrt-docUpgrade rubygem-test-unitUpgrade rubygem-mysql2-docUpgrade rubygem-rdocUpgrade rubygem-pgUpgrade ruby-docUpgrade rubygemsUpgrade rubygem-xmlrpcUpgrade rubygems-develUpgrade rubygem-psychUpgrade rubygem-opensslUpgrade rubygem-bsonUpgrade rubygem-bundler-docUpgrade rubygem-mongo-docUpgrade rubygem-did_you_meanUpgrade ruby-default-gems | Aug 7, 2021 | Feb 9, 2021 |
| Redhat_linux | — | Upgrade rubygem-mongoUpgrade rubygem-net-telnetUpgrade rubygem-bson-debuginfoUpgrade rubygem-bundler-docUpgrade ruby-irbUpgrade rubygem-opensslUpgrade rubygem-minitestUpgrade rubygem-openssl-debuginfoUpgrade rubygem-pgUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-default-gemsUpgrade ruby-libsUpgrade rubygem-irbUpgrade ruby-libs-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-bson-debugsourceUpgrade rubygem-pg-docUpgrade rubygem-bson-docUpgrade rubygem-pg-debugsourceUpgrade rubygem-abrt-docUpgrade rubygemsUpgrade rubyUpgrade rubygem-abrtUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-io-consoleUpgrade ruby-debugsourceUpgrade rubygem-bsonUpgrade rubygem-test-unitUpgrade rubygem-rakeUpgrade rubygem-mongo-docUpgrade ruby-debuginfoUpgrade rubygems-develUpgrade rubygem-mysql2-docUpgrade rubygem-rdocUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-debuginfoUpgrade ruby-docUpgrade rubygem-psych-debuginfoUpgrade ruby-develUpgrade rubygem-did_you_meanUpgrade rubygem-psychUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-jsonUpgrade rubygem-json-debuginfoUpgrade rubygem-xmlrpc | Aug 6, 2021 | Apr 29, 2021 |
| Rocky_linux | — | Upgrade ruby-libsUpgrade rubygem-bson-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-bigdecimalUpgrade rubygem-pg-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-jsonUpgrade rubygem-mysql2Upgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-pgUpgrade ruby-debuginfoUpgrade ruby-develUpgrade rubygem-bsonUpgrade rubyUpgrade rubygem-opensslUpgrade rubygem-psychUpgrade ruby-libs-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-psych-debuginfoUpgrade rubygem-io-console-debuginfo | Mar 5, 2024 | Apr 29, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 29, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub