CVE-2020-36327

Name
CVE-2020-36327
Description
Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every "Dependency Confusion" issue in every product.
NVD Severity
high
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-24105
MISC https://github.com/rubygems/rubygems/issues/3982
MISC https://bundler.io/blog/2021/02/15/a-more-secure-bundler-we-fixed-our-source-priorities.html
MISC https://mensfeld.pl/2021/02/rubygems-dependency-confusion-attack-side-of-things/
MISC https://www.zofrex.com/blog/2021/04/29/bundler-still-vulnerable-dependency-confusion-cve-2020-36327/
FEDORA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MWXHK5UUHVSHF7HTHMX6JY3WXDVNIHSL/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:bundler:bundler:*:*:*:*:*:ruby:*:* ruby-bundler >= 1.16.0 < 2.2.10
cpe:2.3:a:bundler:bundler:*:*:*:*:*:ruby:*:* ruby-bundler >= 2.2.11 <= 2.2.16

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
ruby-bundler 3.13-main 2.2.2-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
ruby-bundler 3.12-main 2.1.4-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
ruby-bundler 3.11-main 2.0.2-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
ruby-bundler 3.10-main 2.0.2-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable