Lucene search
HistoryDec 22, 2016 - 10:59 p.m.
CVE-2016-7954
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.5 High
AI Score
Confidence
High
0.009 Low
EPSS
Percentile
82.6%
Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2013-0334.
Affected configurations
Node
bundlerbundlerMatch1.0.0
ORbundlerbundlerMatch1.0.0beta1
ORbundlerbundlerMatch1.0.0beta10
ORbundlerbundlerMatch1.0.0beta6
ORbundlerbundlerMatch1.0.0beta7
ORbundlerbundlerMatch1.0.0beta8
ORbundlerbundlerMatch1.0.0beta9
ORbundlerbundlerMatch1.0.0rc1
ORbundlerbundlerMatch1.0.0rc2
ORbundlerbundlerMatch1.0.0rc3
ORbundlerbundlerMatch1.0.0rc4
ORbundlerbundlerMatch1.0.0rc5
ORbundlerbundlerMatch1.0.0rc6
ORbundlerbundlerMatch1.0.1
ORbundlerbundlerMatch1.0.2
ORbundlerbundlerMatch1.0.3
ORbundlerbundlerMatch1.0.4
ORbundlerbundlerMatch1.0.5
ORbundlerbundlerMatch1.0.6
ORbundlerbundlerMatch1.0.7
ORbundlerbundlerMatch1.0.8
ORbundlerbundlerMatch1.0.9
ORbundlerbundlerMatch1.0.10
ORbundlerbundlerMatch1.0.11
ORbundlerbundlerMatch1.0.12
ORbundlerbundlerMatch1.0.13
ORbundlerbundlerMatch1.0.14
ORbundlerbundlerMatch1.0.15
ORbundlerbundlerMatch1.0.16
ORbundlerbundlerMatch1.0.17
ORbundlerbundlerMatch1.0.18
ORbundlerbundlerMatch1.0.19rc
ORbundlerbundlerMatch1.0.20
ORbundlerbundlerMatch1.0.20rc
ORbundlerbundlerMatch1.0.21
ORbundlerbundlerMatch1.0.21rc
ORbundlerbundlerMatch1.1pre
ORbundlerbundlerMatch1.1pre1
ORbundlerbundlerMatch1.1pre10
ORbundlerbundlerMatch1.1pre2
ORbundlerbundlerMatch1.1pre3
ORbundlerbundlerMatch1.1pre4
ORbundlerbundlerMatch1.1pre5
ORbundlerbundlerMatch1.1pre6
ORbundlerbundlerMatch1.1pre7
ORbundlerbundlerMatch1.1pre8
ORbundlerbundlerMatch1.1pre9
ORbundlerbundlerMatch1.1rc
ORbundlerbundlerMatch1.1rc2
ORbundlerbundlerMatch1.1rc3
ORbundlerbundlerMatch1.1rc4
ORbundlerbundlerMatch1.1rc5
ORbundlerbundlerMatch1.1rc6
ORbundlerbundlerMatch1.1rc7
ORbundlerbundlerMatch1.1rc8
ORbundlerbundlerMatch1.1.0
ORbundlerbundlerMatch1.1.1
ORbundlerbundlerMatch1.1.2
ORbundlerbundlerMatch1.1.3
ORbundlerbundlerMatch1.1.4
ORbundlerbundlerMatch1.1.5
ORbundlerbundlerMatch1.2.0
ORbundlerbundlerMatch1.2.0pre
ORbundlerbundlerMatch1.2.0pre1
ORbundlerbundlerMatch1.2.0rc
ORbundlerbundlerMatch1.2.0rc2
ORbundlerbundlerMatch1.2.1
ORbundlerbundlerMatch1.2.2
ORbundlerbundlerMatch1.2.3
ORbundlerbundlerMatch1.2.4
ORbundlerbundlerMatch1.2.5
ORbundlerbundlerMatch1.3.0
ORbundlerbundlerMatch1.3.0pre
ORbundlerbundlerMatch1.3.0pre2
ORbundlerbundlerMatch1.3.0pre3
ORbundlerbundlerMatch1.3.0pre4
ORbundlerbundlerMatch1.3.0pre5
ORbundlerbundlerMatch1.3.0pre6
ORbundlerbundlerMatch1.3.0pre7
ORbundlerbundlerMatch1.3.0pre8
ORbundlerbundlerMatch1.3.1
ORbundlerbundlerMatch1.3.2
ORbundlerbundlerMatch1.3.3
ORbundlerbundlerMatch1.3.4
ORbundlerbundlerMatch1.3.5
ORbundlerbundlerMatch1.3.6
ORbundlerbundlerMatch1.4.0pre1
ORbundlerbundlerMatch1.4.0rc1
ORbundlerbundlerMatch1.5.0
ORbundlerbundlerMatch1.5.0rc1
ORbundlerbundlerMatch1.5.0rc2
ORbundlerbundlerMatch1.5.1
ORbundlerbundlerMatch1.5.2
ORbundlerbundlerMatch1.5.3
ORbundlerbundlerMatch1.6.0
ORbundlerbundlerMatch1.6.1
ORbundlerbundlerMatch1.6.2
ORbundlerbundlerMatch1.6.3
ORbundlerbundlerMatch1.6.4
ORbundlerbundlerMatch1.6.5
ORbundlerbundlerMatch1.6.6
ORbundlerbundlerMatch1.6.7
ORbundlerbundlerMatch1.7.0
ORbundlerbundlerMatch1.7.1
ORbundlerbundlerMatch1.7.2
ORbundlerbundlerMatch1.7.3
ORbundlerbundlerMatch1.7.4
ORbundlerbundlerMatch1.7.5
ORbundlerbundlerMatch1.7.6
ORbundlerbundlerMatch1.7.7
ORbundlerbundlerMatch1.7.8
ORbundlerbundlerMatch1.7.9
ORbundlerbundlerMatch1.7.10
ORbundlerbundlerMatch1.7.11
ORbundlerbundlerMatch1.7.12
ORbundlerbundlerMatch1.7.13
ORbundlerbundlerMatch1.7.14
ORbundlerbundlerMatch1.7.15
ORbundlerbundlerMatch1.8.0
ORbundlerbundlerMatch1.8.0pre
ORbundlerbundlerMatch1.8.0rc
ORbundlerbundlerMatch1.8.1
ORbundlerbundlerMatch1.8.2
ORbundlerbundlerMatch1.8.3
ORbundlerbundlerMatch1.8.4
ORbundlerbundlerMatch1.8.5
ORbundlerbundlerMatch1.8.6
ORbundlerbundlerMatch1.8.7
ORbundlerbundlerMatch1.8.8
ORbundlerbundlerMatch1.8.9
ORbundlerbundlerMatch1.9.0
ORbundlerbundlerMatch1.9.0pre
ORbundlerbundlerMatch1.9.0pre1
ORbundlerbundlerMatch1.9.0rc
ORbundlerbundlerMatch1.9.1
ORbundlerbundlerMatch1.9.2
ORbundlerbundlerMatch1.9.3
ORbundlerbundlerMatch1.9.4
ORbundlerbundlerMatch1.9.5
ORbundlerbundlerMatch1.9.6
ORbundlerbundlerMatch1.9.7
ORbundlerbundlerMatch1.9.8
ORbundlerbundlerMatch1.9.9
ORbundlerbundlerMatch1.9.10
ORbundlerbundlerMatch1.10.0
ORbundlerbundlerMatch1.10.0pre
ORbundlerbundlerMatch1.10.0pre1
ORbundlerbundlerMatch1.10.0pre2
ORbundlerbundlerMatch1.10.0rc
ORbundlerbundlerMatch1.10.1
ORbundlerbundlerMatch1.10.2
ORbundlerbundlerMatch1.10.3
ORbundlerbundlerMatch1.10.4
ORbundlerbundlerMatch1.10.5
ORbundlerbundlerMatch1.10.6
ORbundlerbundlerMatch1.11.0
ORbundlerbundlerMatch1.11.0pre1
ORbundlerbundlerMatch1.11.0pre2
ORbundlerbundlerMatch1.11.1
ORbundlerbundlerMatch1.11.2
ORbundlerbundlerMatch1.12.0
ORbundlerbundlerMatch1.12.0pre1
ORbundlerbundlerMatch1.12.0pre2
ORbundlerbundlerMatch1.12.0rc
ORbundlerbundlerMatch1.12.0rc2
ORbundlerbundlerMatch1.12.0rc3
ORbundlerbundlerMatch1.12.0rc4
ORbundlerbundlerMatch1.12.1
ORbundlerbundlerMatch1.12.2
ORbundlerbundlerMatch1.12.3
ORbundlerbundlerMatch1.12.4
ORbundlerbundlerMatch1.12.5
ORbundlerbundlerMatch1.12.6
ORbundlerbundlerMatch1.13.0
ORbundlerbundlerMatch1.13.0pre1
ORbundlerbundlerMatch1.13.0rc1
ORbundlerbundlerMatch1.13.0rc2
ORbundlerbundlerMatch1.13.1
ORbundlerbundlerMatch1.13.2
ORbundlerbundlerMatch1.13.3
ORbundlerbundlerMatch1.13.4
ORbundlerbundlerMatch1.13.5
ORbundlerbundlerMatch1.13.6
References
collectiveidea.com/blog/archives/2016/10/06/bundlers-multiple-source-security-vulnerability/
www.openwall.com/lists/oss-security/2016/10/04/5
www.openwall.com/lists/oss-security/2016/10/04/7
www.openwall.com/lists/oss-security/2016/10/05/3
www.securityfocus.com/bid/93423
bugzilla.redhat.com/show_bug.cgi?id=1381951
github.com/bundler/bundler/issues/5051
github.com/bundler/bundler/issues/5062
Related
debiancve
debiancve
CVE-2016-7954
2016-12-22 22:59:00
CVE-2013-0334
2014-10-31 14:55:02
cvelist
cvelist
CVE-2016-7954
2016-12-22 22:00:00
CVE-2013-0334
2014-10-31 14:00:00
cve
cve
CVE-2016-7954
2016-12-22 22:59:00
CVE-2013-0334
2014-10-31 14:55:02
github
github
Bundler allows attacker to inject arbitrary code via secondary Gem source
2022-05-14 00:57:16
Bundler may install gems from a different source than expected
2022-05-05 02:48:48
osv
osv
Bundler allows attacker to inject arbitrary code via secondary Gem source
2022-05-14 00:57:16
Bundler may install gems from a different source than expected
2022-05-05 02:48:48
prion
prion
Design/Logic Flaw
2016-12-22 22:59:00
Code injection
2014-10-31 14:55:00
ubuntucve
ubuntucve
CVE-2016-7954
2016-12-22 00:00:00
CVE-2013-0334
2014-10-31 00:00:00
redhatcve
redhatcve
CVE-2016-7954
2016-10-05 12:47:20
nessus
nessus
RHEL 6 : rubygem-bundler (Unpatched Vulnerability)
2024-05-11 00:00:00
RHEL 6 : rubygem-bundler (Unpatched Vulnerability)
2024-06-03 00:00:00
RHEL 7 : rubygem-bundler (Unpatched Vulnerability)
2024-06-03 00:00:00
oraclelinux
oraclelinux
rubygem-bundler and rubygem-thor security, bug fix, and enhancement update
2015-11-23 00:00:00
fedora
fedora
[SECURITY] Fedora 21 Update: rubygem-bundler-1.7.3-1.fc21
2014-10-12 05:07:35
[SECURITY] Fedora 19 Update: rubygem-bundler-1.7.3-1.fc19
2014-10-12 05:02:47
[SECURITY] Fedora 20 Update: rubygem-bundler-1.7.3-1.fc20
2014-10-12 05:07:22
redhat
redhat
gentoo
gentoo
Bundler: Insecure installation
2016-09-26 00:00:00
nvd
nvd
CVE-2013-0334
2014-10-31 14:55:02
openvas
openvas
RedHat Update for rubygem-bundler and rubygem-thor RHSA-2015:2180-07
2015-11-20 00:00:00
Fedora Update for rubygem-bundler FEDORA-2014-11630
2014-10-13 00:00:00
Fedora Update for rubygem-bundler FEDORA-2014-11649
2014-10-13 00:00:00
centos
centos
rubygem security update
2015-11-30 19:51:23
rubygems
rubygems
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.5 High
AI Score
Confidence
High
0.009 Low
EPSS
Percentile
82.6%
Related for NVD:CVE-2016-7954