CVE-2016-7954
CriticalSummary
Bundler 1.x may allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source.
Risk Assessment
Attackers could exploit this vulnerability to gain control over the application, potentially leading to serious security implications for the organization.
Recommendation
It is recommended to update Bundler to the latest version and monitor the gems in use to avoid name collisions.
Other vulnerabilities in Bundler 1.x
See all- CVE-2020-36327High
Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, meaning a rogue gem from a public source may be chosen even if the intended choice was a private gem.
- CVE-2021-43809Medium
A vulnerability in Bundler versions before 2.2.33 allows arbitrary code execution when processing untrusted Gemfile. If a Gemfile contains a git dependency with a URL starting with a dash (e.g., '-u./payload'), Bundler may interpret it as a git clone option, leading to code execution.
Original NVD description (English source)
Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2013-0334.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS