CVE-2020-36327
HighCVSS 8.8Exploitation Probability (EPSS)
Very high risk93th percentile - higher than 93% of all known CVEs
Summary
Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, meaning a rogue gem from a public source may be chosen even if the intended choice was a private gem.
Risk Assessment
May lead to a Dependency Confusion attack where a malicious package is installed, potentially resulting in code execution in the build environment.
Recommendation
Upgrade Bundler to a version later than 2.2.16 that fixes this vulnerability, and pin dependencies to trusted sources.
Other vulnerabilities in Bundler
See all- CVE-2016-7954Critical
Bundler 1.x may allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source.
- CVE-2021-43809Medium
A vulnerability in Bundler versions before 2.2.33 allows arbitrary code execution when processing untrusted Gemfile. If a Gemfile contains a git dependency with a URL starting with a dash (e.g., '-u./payload'), Bundler may interpret it as a git clone option, leading to code execution.
Original NVD description (English source)
Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every "Dependency Confusion" issue in every product.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS