kritisch
CVE-2016-7954
rubygem-bundler: Code execution via gem name collision in bundler
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat4.9CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, GHSA, Ruby Advisory DB. Niedriger laut Red Hat (mittel), Ubuntu (mittel).
Beschreibung
Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2013-0334.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| rubygems::GitHub Security Advisory RubyGems | bundler | 2.0.0 |
| rubygems::Ruby Advisory Database | bundler | >= 2.0.0 |
| debian 10 | bundler | kein Fix angegeben |
| debian 7 | bundler | kein Fix angegeben |
| debian 8 | bundler | kein Fix angegeben |
| debian 9 | bundler | kein Fix angegeben |
| Red Hat | rh-ruby22-rubygem-bundler, rh-ruby22-rubygem-bundler-doc, rh-ruby23-rubygem-bundler und 5 weitere | kein Fix angegeben |
| ubuntu 18.04-ESM | bundler | kein Fix angegeben |
Alle 15 Einträge aus 8 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| rubygems::GitHub Security Advisory RubyGems | bundler | 2.0.0 |
| rubygems::Ruby Advisory Database | bundler | >= 2.0.0 |
| debian 10 | bundler | kein Fix angegeben |
| debian 7 | bundler | kein Fix angegeben |
| debian 8 | bundler | kein Fix angegeben |
| debian 9 | bundler | kein Fix angegeben |
| Red Hat | rh-ruby22-rubygem-bundler | kein Fix angegeben |
| Red Hat | rh-ruby22-rubygem-bundler-doc | kein Fix angegeben |
| Red Hat | rh-ruby23-rubygem-bundler | kein Fix angegeben |
| Red Hat | rh-ruby23-rubygem-bundler-doc | kein Fix angegeben |
| Red Hat | rh-ruby24-rubygem-bundler | kein Fix angegeben |
| Red Hat | rh-ruby24-rubygem-bundler-doc | kein Fix angegeben |
| Red Hat | rubygem-bundler | kein Fix angegeben |
| Red Hat | rubygem-bundler-doc | kein Fix angegeben |
| ubuntu 18.04-ESM | bundler | kein Fix angegeben |
Referenzen
- http://collectiveidea.com/blog/archives/2016/10/06/bundlers-multiple-source-security-vulnerability
- http://collectiveidea.com/blog/archives/2016/10/06/bundlers-multiple-source-security-vulnerability/
- http://www.openwall.com/lists/oss-security/2016/10/04/5
- http://www.openwall.com/lists/oss-security/2016/10/04/7
- http://www.openwall.com/lists/oss-security/2016/10/05/3
- http://www.securityfocus.com/bid/93423
- https://access.redhat.com/security/cve/CVE-2016-7954
- https://bugzilla.redhat.com/show_bug.cgi?id=1381951
Alle 27 Referenzen
- https://bundler.io/blog/2014/08/14/bundler-may-install-gems-from-a-different-source-than-expected-cve-2013-0334.html
- https://collectiveidea.com/blog/archives/2016/10/06/bundlers-multiple-source-security-vulnerability
- https://github.com/advisories/GHSA-jvgm-pfqv-887x
- https://github.com/bundler/bundler/issues/5051
- https://github.com/bundler/bundler/issues/5062
- https://github.com/bundler/bundler/issues/5274
- https://github.com/rubygems/bundler
- https://github.com/rubygems/bundler/issues/3671
- https://github.com/rubygems/bundler/issues/5051
- https://github.com/rubygems/bundler/issues/5062
- https://github.com/rubygems/bundler/issues/5274
- https://github.com/rubygems/bundler/pull/3696
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bundler/CVE-2016-7954.yml
- https://nvd.nist.gov/vuln/detail/CVE-2016-7954
- https://seclists.org/oss-sec/2016/q4/18
- https://seclists.org/oss-sec/2016/q4/20
- https://seclists.org/oss-sec/2016/q4/25
- https://web.archive.org/web/20170214030311/http://www.securityfocus.com/bid/93423
- https://www.cve.org/CVERecord?id=CVE-2016-7954