CVE-2016-7954 Bundler allows attacker to inject arbitrary code via secondary Gem source

What is CVE-2016-7954?

CVE-2016-7954 is a critical code injection vulnerability in n/a, published on 22 Dec 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2013-0334.

Weakness: CWE-94

Which versions are affected by CVE-2016-7954?

2 open source packages ship an affected version, including bundler. It affects 1 product.

Products include Bundler Bundler.

How do I fix CVE-2016-7954?

Upgrade bundler to 2.0.0 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2016-7954 being exploited?

There is no known exploitation of CVE-2016-7954 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2020-36327 Dependency Confusion in Bundler High 8.8
• CVE-2019-3881 Insecure path handling in Bundler High 7.8
• CVE-2021-43809 Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile Medium 6.7
• CVE-2013-0334 Bundler may install gems from a different source than expected Medium 5.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jvgm-pfqv-887x, UBUNTU-CVE-2016-7954.