critical
CVE-2016-7954
rubygem-bundler: Code execution via gem name collision in bundler
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat4.9CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Trivy's own label is CRITICAL. Rated critical by NVD, GHSA, Ruby Advisory DB. Rated lower by Red Hat (medium), Ubuntu (medium).
Description
Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2013-0334.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| rubygems::GitHub Security Advisory RubyGems | bundler | 2.0.0 |
| rubygems::Ruby Advisory Database | bundler | >= 2.0.0 |
| debian 10 | bundler | no fix listed |
| debian 7 | bundler | no fix listed |
| debian 8 | bundler | no fix listed |
| debian 9 | bundler | no fix listed |
| Red Hat | rh-ruby22-rubygem-bundler, rh-ruby22-rubygem-bundler-doc, rh-ruby23-rubygem-bundler and 5 more | no fix listed |
| ubuntu 18.04-ESM | bundler | no fix listed |
Show all 15 entries from 8 sources
| Source | Package | Fixed in |
|---|---|---|
| rubygems::GitHub Security Advisory RubyGems | bundler | 2.0.0 |
| rubygems::Ruby Advisory Database | bundler | >= 2.0.0 |
| debian 10 | bundler | no fix listed |
| debian 7 | bundler | no fix listed |
| debian 8 | bundler | no fix listed |
| debian 9 | bundler | no fix listed |
| Red Hat | rh-ruby22-rubygem-bundler | no fix listed |
| Red Hat | rh-ruby22-rubygem-bundler-doc | no fix listed |
| Red Hat | rh-ruby23-rubygem-bundler | no fix listed |
| Red Hat | rh-ruby23-rubygem-bundler-doc | no fix listed |
| Red Hat | rh-ruby24-rubygem-bundler | no fix listed |
| Red Hat | rh-ruby24-rubygem-bundler-doc | no fix listed |
| Red Hat | rubygem-bundler | no fix listed |
| Red Hat | rubygem-bundler-doc | no fix listed |
| ubuntu 18.04-ESM | bundler | no fix listed |
References
- http://collectiveidea.com/blog/archives/2016/10/06/bundlers-multiple-source-security-vulnerability
- http://collectiveidea.com/blog/archives/2016/10/06/bundlers-multiple-source-security-vulnerability/
- http://www.openwall.com/lists/oss-security/2016/10/04/5
- http://www.openwall.com/lists/oss-security/2016/10/04/7
- http://www.openwall.com/lists/oss-security/2016/10/05/3
- http://www.securityfocus.com/bid/93423
- https://access.redhat.com/security/cve/CVE-2016-7954
- https://bugzilla.redhat.com/show_bug.cgi?id=1381951
All 27 references
- https://bundler.io/blog/2014/08/14/bundler-may-install-gems-from-a-different-source-than-expected-cve-2013-0334.html
- https://collectiveidea.com/blog/archives/2016/10/06/bundlers-multiple-source-security-vulnerability
- https://github.com/advisories/GHSA-jvgm-pfqv-887x
- https://github.com/bundler/bundler/issues/5051
- https://github.com/bundler/bundler/issues/5062
- https://github.com/bundler/bundler/issues/5274
- https://github.com/rubygems/bundler
- https://github.com/rubygems/bundler/issues/3671
- https://github.com/rubygems/bundler/issues/5051
- https://github.com/rubygems/bundler/issues/5062
- https://github.com/rubygems/bundler/issues/5274
- https://github.com/rubygems/bundler/pull/3696
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bundler/CVE-2016-7954.yml
- https://nvd.nist.gov/vuln/detail/CVE-2016-7954
- https://seclists.org/oss-sec/2016/q4/18
- https://seclists.org/oss-sec/2016/q4/20
- https://seclists.org/oss-sec/2016/q4/25
- https://web.archive.org/web/20170214030311/http://www.securityfocus.com/bid/93423
- https://www.cve.org/CVERecord?id=CVE-2016-7954