CVE-2019-3881 Insecure path handling in Bundler
An attacker can execute malicious code by placing files in a predictable temporary directory when the user's home directory is not writable.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-3881?
CVE-2019-3881 is a high-severity path traversal vulnerability in rubygem-bundler, published on 4 Sep 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.
Weakness: CWE-427
Which versions are affected by CVE-2019-3881?
2 open source packages ship an affected version, including bundler. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
bundler RubyGems | From 1.14.0 | 2.1.0 |
bundler RubyGems | From 1.14.0 | 2.1.0 |
Linux distribution packages (4)
rubygem-bundler SUSE:Linux Enterprise Module for Basesystem 15 SP1 | All versions | 1.16.1-3.3.1 |
rubygem-bundler SUSE:Linux Enterprise Module for Basesystem 15 SP2 | All versions | 1.16.1-3.3.1 |
rubygem-bundler openSUSE:Leap 15.1 | All versions | 1.16.1-lp151.3.3.1 |
rubygem-bundler openSUSE:Leap 15.2 | All versions | 1.16.1-lp152.4.3.1 |
Products include Bundler Bundler.
How do I fix CVE-2019-3881?
Upgrade bundler to 2.1.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2019-3881 being exploited?
There is no known exploitation of CVE-2019-3881 in the wild and no public exploit code.
Other vulnerabilities in rubygem-bundler
- CVE-2016-7954 Bundler allows attacker to inject arbitrary code via secondary Gem source
- CVE-2020-36327 Dependency Confusion in Bundler
- CVE-2021-43809 Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile
- CVE-2013-0334 Bundler may install gems from a different source than expected
Sources
Also known as GHSA-g98m-96g9-wfjq, OESA-2021-1419, SUSE-SU-2020:1582-1, SUSE-SU-2020:1582-2, UBUNTU-CVE-2019-3881, USN-4870-1 and 2 more.