Search for packages
| purl | pkg:gem/bundler@1.7.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-e1c6-7d44-gqc8
Aliases: CVE-2019-3881 GHSA-g98m-96g9-wfjq |
Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed. |
Affected by 2 other vulnerabilities. |
|
VCID-hk69-vd9p-wfb3
Aliases: CVE-2021-43809 GHSA-fj7f-vq84-fh43 |
arbitrary command execution |
Affected by 0 other vulnerabilities. |
|
VCID-rsuu-68yw-tkbu
Aliases: CVE-2016-7954 GHSA-jvgm-pfqv-887x |
Bundler allows attacker to inject arbitrary code via secondary Gem source Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2013-0334. |
Affected by 3 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-b8s1-g8qy-yud5 | Bundler may install gems from a different source than expected Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source. |
CVE-2013-0334
GHSA-49jx-9cmc-xjxm OSV-110004 |