{"action":"Upgrade bundler to 2.2.10 or later.","affected":[{"fixed":"2.2.10","introduced":"1.16.0"},{"fixed":"2.2.18","introduced":"2.2.11"}],"component":"bundler","cve_ids":["CVE-2020-36327"],"ecosystem":"RubyGems","epss":0.06307,"exploited":false,"fixed_versions":["2.2.10","2.2.18"],"ghsa_id":"GHSA-fp4w-jxhp-m23p","id":"tcs_01M5KEK3X0Y0T07Y3R6QA64MR9","modified_at":"2024-12-05T05:42:55.716134Z","published_at":"2021-05-24T18:12:33Z","references":["https://osv.dev/vulnerability/GHSA-fp4w-jxhp-m23p","https://nvd.nist.gov/vuln/detail/CVE-2020-36327","https://github.com/rubygems/rubygems/issues/3982","https://github.com/rubygems/rubygems/pull/4609","https://github.com/rubygems/rubygems/commit/078bf682ac40017b309b5fc69f283ff640e7c129","https://bundler.io/blog/2021/02/15/a-more-secure-bundler-we-fixed-our-source-priorities.html","https://github.com/rubygems/rubygems","https://github.com/rubygems/rubygems/blob/master/bundler/CHANGELOG.md#2218-may-25-2021","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bundler/CVE-2020-36327.yml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MWXHK5UUHVSHF7HTHMX6JY3WXDVNIHSL","https://mensfeld.pl/2021/02/rubygems-dependency-confusion-attack-side-of-things","https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-24105","https://www.zofrex.com/blog/2021/04/29/bundler-still-vulnerable-dependency-confusion-cve-2020-36327"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-fp4w-jxhp-m23p","url":"https://osv.dev/vulnerability/GHSA-fp4w-jxhp-m23p"}],"summary":"Dependency Confusion in Bundler"}