Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every "Dependency Confusion" issue in every product.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-abrt-docUpgrade rubygem-bson-docUpgrade ruby-libsUpgrade rubygem-bigdecimalUpgrade rubygem-jsonUpgrade rubygem-did_you_meanUpgrade rubygem-io-consoleUpgrade rubygem-psychUpgrade rubygem-bsonUpgrade rubygem-rakeUpgrade rubygems-develUpgrade rubygem-pg-docUpgrade ruby-irbUpgrade rubygem-mongo-docUpgrade rubygem-bundlerUpgrade ruby-docUpgrade rubygem-rdocUpgrade rubygem-mysql2-docUpgrade rubygem-opensslUpgrade rubygem-bundler-docUpgrade rubygemsUpgrade rubygem-xmlrpcUpgrade rubygem-test-unitUpgrade ruby-develUpgrade rubygem-power_assertUpgrade rubygem-minitestUpgrade rubygem-abrtUpgrade rubyUpgrade rubygem-mysql2Upgrade rubygem-pgUpgrade rubygem-net-telnetUpgrade rubygem-mongoUpgrade ruby-default-gemsUpgrade rubygem-irb | May 4, 2022 | Apr 29, 2021 |
| Alpine Linux | — | Upgrade ruby-bundler | Mar 21, 2024 | Apr 29, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Apr 29, 2021 |
| Centos_linux | — | Upgrade rubygem-bundler-docUpgrade rubygem-rakeUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-docUpgrade rubygem-xmlrpcUpgrade rubygem-io-console-debuginfoUpgrade rubygemsUpgrade rubygem-net-telnetUpgrade rubygem-rdocUpgrade ruby-irbUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-minitestUpgrade rubygem-abrt-docUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-test-unitUpgrade rubygem-io-consoleUpgrade rubygem-json-debuginfoUpgrade rubygems-develUpgrade ruby-debuginfoUpgrade rubygem-bson-docUpgrade rubygem-psych-debuginfoUpgrade rubygem-psychUpgrade ruby-libsUpgrade rubygem-bundlerUpgrade rubygem-abrtUpgrade rubyUpgrade rubygem-jsonUpgrade rubygem-irbUpgrade rubygem-bson-debuginfoUpgrade rubygem-power_assertUpgrade ruby-docUpgrade rubygem-pg-debuginfoUpgrade rubygem-bsonUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-bson-debugsourceUpgrade ruby-debugsourceUpgrade rubygem-opensslUpgrade rubygem-mongoUpgrade rubygem-did_you_meanUpgrade rubygem-pgUpgrade ruby-default-gemsUpgrade rubygem-pg-docUpgrade rubygem-mysql2Upgrade ruby-libs-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade ruby-devel | Aug 6, 2021 | Apr 29, 2021 |
| Debian | — | Upgrade rubygems | Jul 30, 2024 | Apr 29, 2021 |
| Gentoo Linux | — | Upgrade dev-ruby/bundler. | Aug 12, 2024 | Apr 29, 2021 |
| Oracle_linux | — | Upgrade ruby-docUpgrade rubygem-pgUpgrade rubygemsUpgrade rubygem-rdocUpgrade rubygem-xmlrpcUpgrade rubygems-develUpgrade rubygem-mongo-docUpgrade rubygem-opensslUpgrade rubygem-psychUpgrade rubygem-abrt-docUpgrade rubygem-did_you_meanUpgrade rubygem-test-unitUpgrade ruby-default-gemsUpgrade rubygem-mysql2-docUpgrade rubygem-net-telnetUpgrade rubygem-bsonUpgrade rubygem-irbUpgrade rubygem-bundler-docUpgrade rubyUpgrade rubygem-minitestUpgrade ruby-develUpgrade rubygem-rakeUpgrade ruby-irbUpgrade rubygem-jsonUpgrade rubygem-power_assertUpgrade rubygem-mysql2Upgrade rubygem-bundlerUpgrade rubygem-bigdecimalUpgrade rubygem-abrtUpgrade rubygem-pg-docUpgrade rubygem-mongoUpgrade rubygem-io-consoleUpgrade rubygem-bson-docUpgrade ruby-libs | Aug 7, 2021 | Feb 9, 2021 |
| Redhat_linux | — | Upgrade ruby-develUpgrade ruby-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-xmlrpcUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade rubygem-bsonUpgrade rubygem-rdocUpgrade rubygem-mysql2-debuginfoUpgrade ruby-debugsourceUpgrade rubygems-develUpgrade rubygem-psych-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-test-unitUpgrade rubygem-rakeUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-json-debuginfoUpgrade rubygem-mongo-docUpgrade ruby-docUpgrade rubygem-bundlerUpgrade rubygem-did_you_meanUpgrade rubygem-io-consoleUpgrade rubygem-irbUpgrade rubygem-mongoUpgrade rubygemsUpgrade rubygem-bundler-docUpgrade rubyUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mysql2Upgrade ruby-default-gemsUpgrade rubygem-bson-debugsourceUpgrade rubygem-pg-debugsourceUpgrade rubygem-pgUpgrade rubygem-net-telnetUpgrade rubygem-abrtUpgrade rubygem-opensslUpgrade rubygem-minitestUpgrade rubygem-io-console-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-bson-docUpgrade rubygem-pg-docUpgrade rubygem-bson-debuginfoUpgrade ruby-libsUpgrade rubygem-abrt-docUpgrade rubygem-power_assertUpgrade ruby-irbUpgrade rubygem-bigdecimal-debuginfo | Aug 6, 2021 | Apr 29, 2021 |
| Rocky_linux | — | Upgrade ruby-develUpgrade rubygem-pg-debugsourceUpgrade rubygem-psychUpgrade ruby-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pgUpgrade rubyUpgrade rubygem-opensslUpgrade rubygem-bsonUpgrade ruby-libs-debuginfoUpgrade rubygem-jsonUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bson-debugsourceUpgrade ruby-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-bigdecimalUpgrade rubygem-bson-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-pg-debuginfoUpgrade ruby-libsUpgrade rubygem-mysql2-debugsource | Mar 5, 2024 | Apr 29, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 29, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub