Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mongoUpgrade rubygem-bson-docUpgrade rubygem-abrt-docUpgrade rubygem-pgUpgrade rubygem-mongo-docUpgrade rubygem-bsonUpgrade rubygem-mysql2-docUpgrade rubygem-abrtUpgrade rubygem-pg-docUpgrade rubygem-mysql2 | May 4, 2022 | Sep 4, 2020 |
| Centos_linux | — | Upgrade ruby-debugsourceUpgrade rubygem-net-telnetUpgrade rubygem-irbUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bson-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade ruby-develUpgrade rubygem-pg-docUpgrade ruby-libsUpgrade rubyUpgrade rubygem-mysql2Upgrade rubygem-pg-debugsourceUpgrade rubygem-bson-docUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-rakeUpgrade rubygem-minitestUpgrade rubygem-io-console-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-pg-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-mongoUpgrade rubygems-develUpgrade rubygem-abrtUpgrade rubygem-bson-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-psychUpgrade rubygem-xmlrpcUpgrade ruby-libs-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygemsUpgrade rubygem-pgUpgrade rubygem-json-debuginfoUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade rubygem-abrt-docUpgrade rubygem-opensslUpgrade rubygem-test-unitUpgrade rubygem-jsonUpgrade rubygem-bsonUpgrade rubygem-psych-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-rdocUpgrade rubygem-mongo-doc | Jun 30, 2021 | Sep 4, 2020 |
| Freebsd | — | Upgrade gitlab-ce | Jan 10, 2021 | Jan 9, 2021 |
| Gentoo Linux | — | Upgrade dev-ruby/bundler. | Aug 12, 2024 | Sep 4, 2020 |
| Oracle_linux | — | Upgrade rubyUpgrade rubygem-rdocUpgrade rubygem-opensslUpgrade rubygem-minitestUpgrade rubygem-net-telnetUpgrade ruby-develUpgrade rubygem-mysql2-docUpgrade rubygem-irbUpgrade rubygem-xmlrpcUpgrade rubygem-bundlerUpgrade rubygem-pgUpgrade rubygemsUpgrade rubygems-develUpgrade rubygem-test-unitUpgrade rubygem-power_assertUpgrade ruby-docUpgrade rubygem-mongoUpgrade rubygem-abrtUpgrade ruby-libsUpgrade rubygem-pg-docUpgrade rubygem-io-consoleUpgrade rubygem-abrt-docUpgrade rubygem-psychUpgrade rubygem-mysql2Upgrade rubygem-did_you_meanUpgrade rubygem-bigdecimalUpgrade rubygem-bson-docUpgrade rubygem-jsonUpgrade rubygem-rakeUpgrade rubygem-bsonUpgrade rubygem-mongo-doc | Jul 8, 2021 | May 23, 2018 |
| Redhat_linux | — | Upgrade rubygem-mongo-docUpgrade rubygem-irbUpgrade ruby-debugsourceUpgrade rubygem-abrtUpgrade rubygem-did_you_meanUpgrade rubygem-opensslUpgrade rubygem-openssl-debuginfoUpgrade ruby-docUpgrade rubygem-bundlerNo solution existsUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade ruby-develUpgrade rubygem-mysql2-debuginfoUpgrade rubyUpgrade rubygem-mysql2Upgrade rubygem-bson-debuginfoUpgrade ruby-libsUpgrade rubygem-pg-docUpgrade rubygem-pg-debugsourceUpgrade rubygem-pgUpgrade rubygem-rakeUpgrade rubygem-bsonUpgrade rubygem-psych-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-xmlrpcUpgrade rubygem-power_assertUpgrade rubygem-bson-debugsourceUpgrade rubygem-test-unitUpgrade ruby-debuginfoUpgrade rubygem-json-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-pg-debuginfoUpgrade rubygem-mongoUpgrade rubygem-net-telnetUpgrade rubygem-io-consoleUpgrade rubygem-minitestUpgrade rubygem-bson-docUpgrade rubygem-io-console-debuginfoUpgrade rubygems-develUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mysql2-docUpgrade rubygemsUpgrade rubygem-rdoc | Jun 30, 2021 | Sep 4, 2020 |
| Rocky_linux | — | Upgrade rubygem-pgUpgrade rubygem-psych-debuginfoUpgrade rubyUpgrade rubygem-opensslUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade ruby-develUpgrade ruby-libs-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-bsonUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-bson-debuginfoUpgrade rubygem-jsonUpgrade ruby-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade rubygem-psychUpgrade ruby-libsUpgrade rubygem-json-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-bigdecimal | May 5, 2022 | Sep 4, 2020 |
| Suse | — | Upgrade ruby2.5-rubygem-bundler-docUpgrade ruby2.5-rubygem-bundler | Jun 13, 2020 | Jun 9, 2020 |
| Ubuntu | — | Upgrade ruby-bundler (Ubuntu Pro)Upgrade bundler (Ubuntu Pro) | Mar 22, 2023 | Sep 4, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 4, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub