kritik
CVE-2016-7954
rubygem-bundler: Code execution via gem name collision in bundler
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat4.9CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, GHSA, Ruby Advisory DB. Daha düşük diyenler: Red Hat (orta), Ubuntu (orta).
Açıklama
Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2013-0334.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| rubygems::GitHub Security Advisory RubyGems | bundler | 2.0.0 |
| rubygems::Ruby Advisory Database | bundler | >= 2.0.0 |
| debian 10 | bundler | düzeltme belirtilmemiş |
| debian 7 | bundler | düzeltme belirtilmemiş |
| debian 8 | bundler | düzeltme belirtilmemiş |
| debian 9 | bundler | düzeltme belirtilmemiş |
| Red Hat | rh-ruby22-rubygem-bundler, rh-ruby22-rubygem-bundler-doc, rh-ruby23-rubygem-bundler ve 5 tane daha | düzeltme belirtilmemiş |
| ubuntu 18.04-ESM | bundler | düzeltme belirtilmemiş |
8 kaynaktaki 15 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| rubygems::GitHub Security Advisory RubyGems | bundler | 2.0.0 |
| rubygems::Ruby Advisory Database | bundler | >= 2.0.0 |
| debian 10 | bundler | düzeltme belirtilmemiş |
| debian 7 | bundler | düzeltme belirtilmemiş |
| debian 8 | bundler | düzeltme belirtilmemiş |
| debian 9 | bundler | düzeltme belirtilmemiş |
| Red Hat | rh-ruby22-rubygem-bundler | düzeltme belirtilmemiş |
| Red Hat | rh-ruby22-rubygem-bundler-doc | düzeltme belirtilmemiş |
| Red Hat | rh-ruby23-rubygem-bundler | düzeltme belirtilmemiş |
| Red Hat | rh-ruby23-rubygem-bundler-doc | düzeltme belirtilmemiş |
| Red Hat | rh-ruby24-rubygem-bundler | düzeltme belirtilmemiş |
| Red Hat | rh-ruby24-rubygem-bundler-doc | düzeltme belirtilmemiş |
| Red Hat | rubygem-bundler | düzeltme belirtilmemiş |
| Red Hat | rubygem-bundler-doc | düzeltme belirtilmemiş |
| ubuntu 18.04-ESM | bundler | düzeltme belirtilmemiş |
Referanslar
- http://collectiveidea.com/blog/archives/2016/10/06/bundlers-multiple-source-security-vulnerability
- http://collectiveidea.com/blog/archives/2016/10/06/bundlers-multiple-source-security-vulnerability/
- http://www.openwall.com/lists/oss-security/2016/10/04/5
- http://www.openwall.com/lists/oss-security/2016/10/04/7
- http://www.openwall.com/lists/oss-security/2016/10/05/3
- http://www.securityfocus.com/bid/93423
- https://access.redhat.com/security/cve/CVE-2016-7954
- https://bugzilla.redhat.com/show_bug.cgi?id=1381951
27 referansın hepsi
- https://bundler.io/blog/2014/08/14/bundler-may-install-gems-from-a-different-source-than-expected-cve-2013-0334.html
- https://collectiveidea.com/blog/archives/2016/10/06/bundlers-multiple-source-security-vulnerability
- https://github.com/advisories/GHSA-jvgm-pfqv-887x
- https://github.com/bundler/bundler/issues/5051
- https://github.com/bundler/bundler/issues/5062
- https://github.com/bundler/bundler/issues/5274
- https://github.com/rubygems/bundler
- https://github.com/rubygems/bundler/issues/3671
- https://github.com/rubygems/bundler/issues/5051
- https://github.com/rubygems/bundler/issues/5062
- https://github.com/rubygems/bundler/issues/5274
- https://github.com/rubygems/bundler/pull/3696
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bundler/CVE-2016-7954.yml
- https://nvd.nist.gov/vuln/detail/CVE-2016-7954
- https://seclists.org/oss-sec/2016/q4/18
- https://seclists.org/oss-sec/2016/q4/20
- https://seclists.org/oss-sec/2016/q4/25
- https://web.archive.org/web/20170214030311/http://www.securityfocus.com/bid/93423
- https://www.cve.org/CVERecord?id=CVE-2016-7954