CVE-2016-7954

RubyGems/bundler CVE-2016-7954: critical 9.8

Bundler allows attacker to inject arbitrary code via secondary Gem source

Action: Upgrade bundler to 2.0.0 or later.

bundle update bundler

Affected

Fixed versions

Sources

• osv: GHSA-jvgm-pfqv-887x
• https://nvd.nist.gov/vuln/detail/CVE-2016-7954
• https://github.com/bundler/bundler/issues/5051
• https://github.com/bundler/bundler/issues/5062
• https://bugzilla.redhat.com/show_bug.cgi?id=1381951
• https://collectiveidea.com/blog/archives/2016/10/06/bundlers-multiple-source-security-vulnerability
• https://github.com/rubygems/bundler
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bundler/CVE-2016-7954.yml
• https://web.archive.org/web/20170214030311/http://www.securityfocus.com/bid/93423
• http://collectiveidea.com/blog/archives/2016/10/06/bundlers-multiple-source-security-vulnerability
• http://www.openwall.com/lists/oss-security/2016/10/04/5
• http://www.openwall.com/lists/oss-security/2016/10/04/7
• http://www.openwall.com/lists/oss-security/2016/10/05/3

CVE-2016-7954 · published 2022-05-14T00:57:16Z · modified 2025-04-14T22:27:57.972251Z · JSON