CVE-2020-36327

CVE-2020-36327

High · published April 29, 2021

CVSS v3.1
8.8
EPSS
6%
Percentile
93.6
In the wild
Unconfirmed
What it is

Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every "Dependency Confusion" issue in every product.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.06307 · 93.6th percentile
Published
2021-04-29T07:15Z
Affected products (4)
ProductVersionsFixed in
bundler/bundler≥ 1.16.0, < 2.2.102.2.10
bundler/bundler≥ 2.2.11, ≤ 2.2.16—
fedoraproject/fedoraall versions—
microsoft/package_manager_configurationsall versions—
References (12)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MWXHK5UUHVSHF7HTHMX6JY3WXDVNIHSL/ · [email protected]https://mensfeld.pl/2021/02/rubygems-dependency-confusion-attack-side-of-things/ · [email protected]https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-24105 · [email protected]https://www.zofrex.com/blog/2021/04/29/bundler-still-vulnerable-dependency-confusion-cve-2020-36327/ · [email protected]https://bundler.io/blog/2021/02/15/a-more-secure-bundler-we-fixed-our-source-priorities.html · af854a3a-2127-422b-91ae-364da2661108https://github.com/rubygems/rubygems/issues/3982 · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MWXHK5UUHVSHF7HTHMX6JY3WXDVNIHSL/ · af854a3a-2127-422b-91ae-364da2661108https://mensfeld.pl/2021/02/rubygems-dependency-confusion-attack-side-of-things/ · af854a3a-2127-422b-91ae-364da2661108https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-24105 · af854a3a-2127-422b-91ae-364da2661108https://www.zofrex.com/blog/2021/04/29/bundler-still-vulnerable-dependency-confusion-cve-2020-36327/ · af854a3a-2127-422b-91ae-364da2661108https://github.com/rubygems/rubygems/issues/3982 · [email protected]https://bundler.io/blog/2021/02/15/a-more-secure-bundler-we-fixed-our-source-priorities.html · [email protected]
EPSS history
Timeline
  • 29 APR 02:28Z
    Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue…
    cvelistv5