CVE-2020-36327

RubyGems/bundler CVE-2020-36327: high 8.8, EPSS 6.31%

Dependency Confusion in Bundler

Action: Upgrade bundler to 2.2.10 or later.

bundle update bundler

Affected

Fixed versions

Sources

• osv: GHSA-fp4w-jxhp-m23p
• https://nvd.nist.gov/vuln/detail/CVE-2020-36327
• https://github.com/rubygems/rubygems/issues/3982
• https://github.com/rubygems/rubygems/pull/4609
• https://github.com/rubygems/rubygems/commit/078bf682ac40017b309b5fc69f283ff640e7c129
• https://bundler.io/blog/2021/02/15/a-more-secure-bundler-we-fixed-our-source-priorities.html
• https://github.com/rubygems/rubygems
• https://github.com/rubygems/rubygems/blob/master/bundler/CHANGELOG.md#2218-may-25-2021
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bundler/CVE-2020-36327.yml
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MWXHK5UUHVSHF7HTHMX6JY3WXDVNIHSL
• https://mensfeld.pl/2021/02/rubygems-dependency-confusion-attack-side-of-things
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-24105
• https://www.zofrex.com/blog/2021/04/29/bundler-still-vulnerable-dependency-confusion-cve-2020-36327

CVE-2020-36327 · published 2021-05-24T18:12:33Z · modified 2024-12-05T05:42:55.716134Z · JSON