Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every "Dependency Confusion" issue in every product.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-bsonUpgrade rubygems-develUpgrade rubygem-pg-docUpgrade rubygem-bigdecimalUpgrade ruby-irbUpgrade rubygem-jsonUpgrade rubygem-abrt-docUpgrade rubygem-did_you_meanUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade ruby-libsUpgrade rubygem-bson-docUpgrade rubygem-rakeUpgrade rubygem-bundler-docUpgrade ruby-default-gemsUpgrade ruby-develUpgrade rubygem-test-unitUpgrade rubygemsUpgrade rubygem-rdocUpgrade rubygem-abrtUpgrade rubygem-irbUpgrade rubygem-mysql2-docUpgrade rubygem-mongoUpgrade rubygem-minitestUpgrade rubygem-bundlerUpgrade rubyUpgrade ruby-docUpgrade rubygem-pgUpgrade rubygem-xmlrpcUpgrade rubygem-power_assertUpgrade rubygem-mysql2Upgrade rubygem-opensslUpgrade rubygem-mongo-docUpgrade rubygem-net-telnet | May 4, 2022 | Apr 29, 2021 |
| Alpine Linux | — | Upgrade ruby-bundler | Mar 21, 2024 | Apr 29, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Apr 29, 2021 |
| Centos_linux | — | Upgrade rubygem-minitestUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-irbUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-xmlrpcUpgrade rubygem-rakeUpgrade rubygem-abrt-docUpgrade ruby-debuginfoUpgrade rubygem-test-unitUpgrade rubygems-develUpgrade rubygem-bigdecimalUpgrade rubygem-bson-docUpgrade rubygemsUpgrade rubygem-io-consoleUpgrade rubygem-net-telnetUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-rdocUpgrade rubygem-json-debuginfoUpgrade rubygem-bundler-docUpgrade rubygem-openssl-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-bson-debugsourceUpgrade ruby-debugsourceUpgrade rubygem-opensslUpgrade ruby-libsUpgrade ruby-develUpgrade rubygem-bundlerUpgrade rubygem-bsonUpgrade rubygem-psych-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-irbUpgrade ruby-libs-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-pgUpgrade ruby-default-gemsUpgrade rubyUpgrade rubygem-jsonUpgrade rubygem-abrtUpgrade rubygem-mysql2Upgrade rubygem-pg-docUpgrade rubygem-mongoUpgrade ruby-docUpgrade rubygem-bson-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-psychUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-mongo-doc | Aug 6, 2021 | Apr 29, 2021 |
| Debian | — | Upgrade rubygems | Jul 30, 2024 | Apr 29, 2021 |
| Gentoo Linux | — | Upgrade dev-ruby/bundler. | Aug 12, 2024 | Apr 29, 2021 |
| Oracle_linux | — | Upgrade rubygem-bundlerUpgrade rubygem-power_assertUpgrade rubygem-rakeUpgrade rubygem-pg-docUpgrade rubygem-abrtUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2Upgrade rubygem-minitestUpgrade ruby-develUpgrade rubygem-bson-docUpgrade ruby-libsUpgrade rubyUpgrade ruby-irbUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade rubygem-mongoUpgrade rubygem-xmlrpcUpgrade rubygem-psychUpgrade rubygem-opensslUpgrade rubygem-mysql2-docUpgrade rubygem-bsonUpgrade rubygem-test-unitUpgrade rubygems-develUpgrade rubygemsUpgrade rubygem-rdocUpgrade rubygem-pgUpgrade ruby-docUpgrade rubygem-mongo-docUpgrade rubygem-irbUpgrade rubygem-did_you_meanUpgrade rubygem-bundler-docUpgrade rubygem-abrt-docUpgrade ruby-default-gemsUpgrade rubygem-net-telnet | Aug 7, 2021 | Feb 9, 2021 |
| Redhat_linux | — | Upgrade rubygem-xmlrpcUpgrade rubygem-bsonUpgrade rubygem-jsonUpgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade ruby-docUpgrade rubygem-bundlerUpgrade ruby-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade ruby-develUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2-docUpgrade ruby-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-rdocUpgrade rubygem-test-unitUpgrade rubygem-pg-debuginfoUpgrade rubygem-psychUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-rakeUpgrade rubygem-did_you_meanUpgrade rubygem-abrtUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-pgUpgrade ruby-default-gemsUpgrade rubygem-pg-debugsourceUpgrade rubygemsUpgrade rubygem-power_assertUpgrade rubygem-irbUpgrade rubyUpgrade rubygem-bson-debuginfoUpgrade rubygem-abrt-docUpgrade ruby-irbUpgrade rubygem-minitestUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bundler-docUpgrade rubygem-mysql2Upgrade rubygem-opensslUpgrade ruby-libsUpgrade rubygem-mongoUpgrade rubygem-bson-docUpgrade rubygem-pg-docUpgrade ruby-libs-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-net-telnet | Aug 6, 2021 | Apr 29, 2021 |
| Rocky_linux | — | Upgrade rubygem-bson-debugsourceUpgrade rubygem-jsonUpgrade ruby-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mysql2Upgrade rubygem-io-consoleUpgrade ruby-libsUpgrade rubygem-bson-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-bigdecimal-debuginfoUpgrade rubyUpgrade ruby-debuginfoUpgrade rubygem-opensslUpgrade rubygem-psychUpgrade rubygem-pg-debugsourceUpgrade ruby-libs-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-pgUpgrade rubygem-io-console-debuginfoUpgrade ruby-develUpgrade rubygem-bson | Mar 5, 2024 | Apr 29, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 29, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub