PT-2021-12010 · Bundler+6 · Bundler+6
Deivid-Rodriguez
+1
·
Published
2021-04-29
·
Updated
2026-04-15
·
CVE-2020-36327
CVSS v2.0
9.3
High
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
Bundler versions 1.16.0 through 2.2.9
Bundler versions 2.2.11 through 2.2.16
Description:
The issue sometimes chooses a dependency source based on the highest gem version number. This means a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem explicitly depended on by the application.
Recommendations:
For Bundler versions 1.16.0 through 2.2.9, consider updating to a version outside of this range to mitigate the risk.
For Bundler versions 2.2.11 through 2.2.16, consider updating to a version outside of this range to mitigate the risk.
As a temporary workaround, consider restricting the use of public gem sources to minimize the risk of exploitation.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Bundler
Centos
Debian
Red Hat
Rocky Linux
Suse