crítica
CVE-2016-7954
rubygem-bundler: Code execution via gem name collision in bundler
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat4.9CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA, Ruby Advisory DB. Más baja según Red Hat (media), Ubuntu (media).
Descripción
Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2013-0334.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| rubygems::GitHub Security Advisory RubyGems | bundler | 2.0.0 |
| rubygems::Ruby Advisory Database | bundler | >= 2.0.0 |
| debian 10 | bundler | sin corrección indicada |
| debian 7 | bundler | sin corrección indicada |
| debian 8 | bundler | sin corrección indicada |
| debian 9 | bundler | sin corrección indicada |
| Red Hat | rh-ruby22-rubygem-bundler, rh-ruby22-rubygem-bundler-doc, rh-ruby23-rubygem-bundler y 5 más | sin corrección indicada |
| ubuntu 18.04-ESM | bundler | sin corrección indicada |
Mostrar las 15 entradas de 8 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| rubygems::GitHub Security Advisory RubyGems | bundler | 2.0.0 |
| rubygems::Ruby Advisory Database | bundler | >= 2.0.0 |
| debian 10 | bundler | sin corrección indicada |
| debian 7 | bundler | sin corrección indicada |
| debian 8 | bundler | sin corrección indicada |
| debian 9 | bundler | sin corrección indicada |
| Red Hat | rh-ruby22-rubygem-bundler | sin corrección indicada |
| Red Hat | rh-ruby22-rubygem-bundler-doc | sin corrección indicada |
| Red Hat | rh-ruby23-rubygem-bundler | sin corrección indicada |
| Red Hat | rh-ruby23-rubygem-bundler-doc | sin corrección indicada |
| Red Hat | rh-ruby24-rubygem-bundler | sin corrección indicada |
| Red Hat | rh-ruby24-rubygem-bundler-doc | sin corrección indicada |
| Red Hat | rubygem-bundler | sin corrección indicada |
| Red Hat | rubygem-bundler-doc | sin corrección indicada |
| ubuntu 18.04-ESM | bundler | sin corrección indicada |
Referencias
- http://collectiveidea.com/blog/archives/2016/10/06/bundlers-multiple-source-security-vulnerability
- http://collectiveidea.com/blog/archives/2016/10/06/bundlers-multiple-source-security-vulnerability/
- http://www.openwall.com/lists/oss-security/2016/10/04/5
- http://www.openwall.com/lists/oss-security/2016/10/04/7
- http://www.openwall.com/lists/oss-security/2016/10/05/3
- http://www.securityfocus.com/bid/93423
- https://access.redhat.com/security/cve/CVE-2016-7954
- https://bugzilla.redhat.com/show_bug.cgi?id=1381951
Las 27 referencias
- https://bundler.io/blog/2014/08/14/bundler-may-install-gems-from-a-different-source-than-expected-cve-2013-0334.html
- https://collectiveidea.com/blog/archives/2016/10/06/bundlers-multiple-source-security-vulnerability
- https://github.com/advisories/GHSA-jvgm-pfqv-887x
- https://github.com/bundler/bundler/issues/5051
- https://github.com/bundler/bundler/issues/5062
- https://github.com/bundler/bundler/issues/5274
- https://github.com/rubygems/bundler
- https://github.com/rubygems/bundler/issues/3671
- https://github.com/rubygems/bundler/issues/5051
- https://github.com/rubygems/bundler/issues/5062
- https://github.com/rubygems/bundler/issues/5274
- https://github.com/rubygems/bundler/pull/3696
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bundler/CVE-2016-7954.yml
- https://nvd.nist.gov/vuln/detail/CVE-2016-7954
- https://seclists.org/oss-sec/2016/q4/18
- https://seclists.org/oss-sec/2016/q4/20
- https://seclists.org/oss-sec/2016/q4/25
- https://web.archive.org/web/20170214030311/http://www.securityfocus.com/bid/93423
- https://www.cve.org/CVERecord?id=CVE-2016-7954