Skip to main content
cve.nowby Sazabi
← RubyGems
RubyGemsPackage

bundler

5 known vulnerabilities (1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 1 medium
Registry
RubyGems

Advisories 5

  • CVE-2021-43809Medium 6.7

    Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile

    Affected: fixed in 2.2.33.

  • Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which

    Affected: from 1.16.0, fixed in 2.2.10; from 2.2.11, fixed in 2.2.18.

  • Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations…

    Affected: from 1.14.0, fixed in 2.1.0.

  • Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a…

    Affected: from 1.0.0, fixed in 2.0.0.

  • Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem…

    Affected: fixed in 1.7.0.