Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every "Dependency Confusion" issue in every product.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade rubygem-psychUpgrade rubygem-pg-docUpgrade rubygem-bsonUpgrade rubygem-did_you_meanUpgrade rubygem-bson-docUpgrade rubygem-bigdecimalUpgrade rubygem-abrt-docUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade rubygems-develUpgrade rubygem-rakeUpgrade rubygem-net-telnetUpgrade rubygem-power_assertUpgrade rubygem-pgUpgrade ruby-default-gemsUpgrade rubygem-irbUpgrade rubygem-rdocUpgrade rubygem-mysql2-docUpgrade rubygem-opensslUpgrade rubygem-mongo-docUpgrade rubygemsUpgrade ruby-develUpgrade rubygem-test-unitUpgrade rubygem-abrtUpgrade ruby-docUpgrade rubygem-bundlerUpgrade rubygem-bundler-docUpgrade rubygem-mysql2Upgrade rubygem-mongoUpgrade rubygem-minitestUpgrade rubyUpgrade rubygem-xmlrpc | May 4, 2022 | Apr 29, 2021 |
| Alpine Linux | — | Upgrade ruby-bundler | Mar 21, 2024 | Apr 29, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Apr 29, 2021 |
| Centos_linux | — | Upgrade ruby-irbUpgrade rubygem-minitestUpgrade rubygem-test-unitUpgrade rubygem-net-telnetUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-rdocUpgrade rubygem-io-console-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-bundler-docUpgrade rubygem-rakeUpgrade rubygem-mysql2-docUpgrade rubygems-develUpgrade rubygem-abrt-docUpgrade rubygem-bson-docUpgrade rubygemsUpgrade rubygem-xmlrpcUpgrade rubygem-bigdecimalUpgrade rubygem-openssl-debuginfoUpgrade ruby-default-gemsUpgrade ruby-debugsourceUpgrade rubygem-opensslUpgrade rubygem-bsonUpgrade ruby-libsUpgrade ruby-develUpgrade rubygem-bundlerUpgrade rubygem-jsonUpgrade rubyUpgrade rubygem-abrtUpgrade rubygem-psychUpgrade ruby-libs-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-pgUpgrade rubygem-psych-debuginfoUpgrade ruby-docUpgrade rubygem-power_assertUpgrade rubygem-irbUpgrade rubygem-bson-debuginfoUpgrade rubygem-mongoUpgrade rubygem-did_you_meanUpgrade rubygem-pg-docUpgrade rubygem-mysql2Upgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-bson-debugsource | Aug 6, 2021 | Apr 29, 2021 |
| Debian | — | Upgrade rubygems | Jul 30, 2024 | Apr 29, 2021 |
| Gentoo Linux | — | Upgrade dev-ruby/bundler. | Aug 12, 2024 | Apr 29, 2021 |
| Oracle_linux | — | Upgrade rubyUpgrade rubygem-bson-docUpgrade rubygem-mongoUpgrade rubygem-minitestUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade ruby-develUpgrade rubygem-abrtUpgrade rubygem-pg-docUpgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade rubygem-bundlerUpgrade rubygem-jsonUpgrade ruby-irbUpgrade rubygem-power_assertUpgrade rubygem-mysql2Upgrade rubygem-mysql2-docUpgrade ruby-default-gemsUpgrade rubygem-test-unitUpgrade rubygem-did_you_meanUpgrade rubygem-bundler-docUpgrade rubygem-rdocUpgrade rubygem-pgUpgrade rubygem-xmlrpcUpgrade rubygems-develUpgrade ruby-docUpgrade rubygemsUpgrade rubygem-net-telnetUpgrade rubygem-irbUpgrade rubygem-mongo-docUpgrade rubygem-opensslUpgrade rubygem-bsonUpgrade rubygem-psychUpgrade rubygem-abrt-doc | Aug 7, 2021 | Feb 9, 2021 |
| Redhat_linux | — | Upgrade rubygem-io-console-debuginfoUpgrade ruby-irbUpgrade ruby-libs-debuginfoUpgrade rubygem-minitestUpgrade rubygem-bson-docUpgrade ruby-default-gemsUpgrade rubygem-mysql2Upgrade rubygem-abrtUpgrade rubygem-abrt-docUpgrade rubyUpgrade rubygem-net-telnetUpgrade rubygem-pg-debugsourceUpgrade rubygemsUpgrade rubygem-irbUpgrade rubygem-power_assertUpgrade rubygem-mongoUpgrade rubygem-pg-docUpgrade ruby-libsUpgrade rubygem-opensslUpgrade rubygem-bundler-docUpgrade rubygem-bson-debuginfoUpgrade rubygem-pgUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-rakeUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-io-consoleUpgrade ruby-develUpgrade rubygems-develUpgrade rubygem-did_you_meanUpgrade rubygem-bsonUpgrade ruby-debugsourceUpgrade rubygem-mysql2-docUpgrade rubygem-xmlrpcUpgrade rubygem-bigdecimalUpgrade rubygem-jsonUpgrade rubygem-pg-debuginfoUpgrade rubygem-psychUpgrade rubygem-test-unitUpgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-rdocUpgrade rubygem-mongo-docUpgrade ruby-docUpgrade ruby-debuginfoUpgrade rubygem-json-debuginfo | Aug 6, 2021 | Apr 29, 2021 |
| Rocky_linux | — | Upgrade rubygem-psychUpgrade rubygem-bsonUpgrade ruby-libs-debuginfoUpgrade ruby-debuginfoUpgrade ruby-develUpgrade rubygem-pg-debugsourceUpgrade rubygem-pgUpgrade rubygem-psych-debuginfoUpgrade rubyUpgrade rubygem-io-console-debuginfoUpgrade rubygem-opensslUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bson-debugsourceUpgrade ruby-libsUpgrade rubygem-json-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-bson-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-jsonUpgrade rubygem-openssl-debuginfo | Mar 5, 2024 | Apr 29, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 29, 2021 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub