Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2013-0334.
| Version | Base score | Base severity | Vector |
|---|
| Hyperlink | Resource Type |
|---|
Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2013-0334.
| Type | CWE ID | Description |
|---|---|---|
| text | N/A | n/a |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://www.securityfocus.com/bid/93423 | vdb-entry x_refsource_BID |
| https://github.com/bundler/bundler/issues/5062 | x_refsource_CONFIRM |
| http://collectiveidea.com/blog/archives/2016/10/06/bundlers-multiple-source-security-vulnerability/ | x_refsource_MISC |
| https://bugzilla.redhat.com/show_bug.cgi?id=1381951 | x_refsource_CONFIRM |
| http://www.openwall.com/lists/oss-security/2016/10/05/3 | mailing-list x_refsource_MLIST |
| http://www.openwall.com/lists/oss-security/2016/10/04/7 | mailing-list x_refsource_MLIST |
| http://www.openwall.com/lists/oss-security/2016/10/04/5 | mailing-list x_refsource_MLIST |
| https://github.com/bundler/bundler/issues/5051 | x_refsource_CONFIRM |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://www.securityfocus.com/bid/93423 | vdb-entry x_refsource_BID x_transferred |
| https://github.com/bundler/bundler/issues/5062 | x_refsource_CONFIRM x_transferred |
| http://collectiveidea.com/blog/archives/2016/10/06/bundlers-multiple-source-security-vulnerability/ | x_refsource_MISC x_transferred |
| https://bugzilla.redhat.com/show_bug.cgi?id=1381951 | x_refsource_CONFIRM x_transferred |
| http://www.openwall.com/lists/oss-security/2016/10/05/3 | mailing-list x_refsource_MLIST x_transferred |
| http://www.openwall.com/lists/oss-security/2016/10/04/7 | mailing-list x_refsource_MLIST x_transferred |
| http://www.openwall.com/lists/oss-security/2016/10/04/5 | mailing-list x_refsource_MLIST x_transferred |
| https://github.com/bundler/bundler/issues/5051 | x_refsource_CONFIRM x_transferred |
Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2013-0334.
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|---|---|---|
| N/A |
| Type | Version | Base score | Base severity | Vector |
|---|---|---|---|---|
| Primary | 3.0 | 9.8 | CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Primary | 2.0 | 7.5 | HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| Hyperlink | Source | Resource |
|---|---|---|
| http://collectiveidea.com/blog/archives/2016/10/06/bundlers-multiple-source-security-vulnerability/ | cve@mitre.org | Exploit Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2016/10/04/5 | cve@mitre.org | Mailing List Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2016/10/04/7 | cve@mitre.org | Mailing List Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2016/10/05/3 | cve@mitre.org | Mailing List Third Party Advisory |
| http://www.securityfocus.com/bid/93423 | cve@mitre.org | Third Party Advisory VDB Entry |
| https://bugzilla.redhat.com/show_bug.cgi?id=1381951 | cve@mitre.org | Issue Tracking |
| https://github.com/bundler/bundler/issues/5051 | cve@mitre.org | Issue Tracking Patch Third Party Advisory |
| https://github.com/bundler/bundler/issues/5062 | cve@mitre.org | Issue Tracking Patch Third Party Advisory |
| http://collectiveidea.com/blog/archives/2016/10/06/bundlers-multiple-source-security-vulnerability/ | af854a3a-2127-422b-91ae-364da2661108 | Exploit Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2016/10/04/5 | af854a3a-2127-422b-91ae-364da2661108 | Mailing List Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2016/10/04/7 | af854a3a-2127-422b-91ae-364da2661108 | Mailing List Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2016/10/05/3 | af854a3a-2127-422b-91ae-364da2661108 | Mailing List Third Party Advisory |
| http://www.securityfocus.com/bid/93423 | af854a3a-2127-422b-91ae-364da2661108 | Third Party Advisory VDB Entry |
| https://bugzilla.redhat.com/show_bug.cgi?id=1381951 | af854a3a-2127-422b-91ae-364da2661108 | Issue Tracking |
| https://github.com/bundler/bundler/issues/5051 | af854a3a-2127-422b-91ae-364da2661108 | Issue Tracking Patch Third Party Advisory |
| https://github.com/bundler/bundler/issues/5062 | af854a3a-2127-422b-91ae-364da2661108 | Issue Tracking Patch Third Party Advisory |