CVE-2020-36327 Dependency Confusion in Bundler
Bundler may install rogue public gems instead of intended private dependencies, allowing attackers to execute arbitrary code via dependency confusion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-36327?
CVE-2020-36327 is a high-severity vulnerability in Fedoraproject Fedora, published on 29 Apr 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every "Dependency Confusion" issue in every product.
Which versions are affected by CVE-2020-36327?
4 open source packages ship an affected version, including bundler. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
bundler RubyGems | From 1.16.0 | 2.2.10 |
bundler RubyGems | From 1.16.0 | 2.2.10 |
bundler RubyGems | From 2.2.11 | 2.2.18 |
bundler RubyGems | From 2.2.11 | 2.2.18 |
Linux distribution packages (36)
ruby AlmaLinux:8 | All versions | 2.5.9-107.module_el8.5.0+2625+ec418553 |
ruby-devel AlmaLinux:8 | All versions | 2.5.9-107.module_el8.5.0+2625+ec418553 |
ruby-doc AlmaLinux:8 | All versions | 2.5.9-107.module_el8.5.0+2625+ec418553 |
ruby-irb AlmaLinux:8 | All versions | 2.5.9-107.module_el8.5.0+2625+ec418553 |
ruby-libs AlmaLinux:8 | All versions | 2.5.9-107.module_el8.5.0+2625+ec418553 |
rubygem-abrt AlmaLinux:8 | All versions | 0.3.0-4.module_el8.5.0+259+8cec6917 |
rubygem-abrt AlmaLinux:8 | All versions | 0.3.0-4.module_el8.5.0+2623+08a8ba32 |
rubygem-abrt AlmaLinux:8 | All versions | 0.3.0-4.module_el8.5.0+2625+ec418553 |
rubygem-abrt-doc AlmaLinux:8 | All versions | 0.3.0-4.module_el8.5.0+259+8cec6917 |
rubygem-abrt-doc AlmaLinux:8 | All versions | 0.3.0-4.module_el8.5.0+2623+08a8ba32 |
rubygem-abrt-doc AlmaLinux:8 | All versions | 0.3.0-4.module_el8.5.0+2625+ec418553 |
rubygem-bigdecimal AlmaLinux:8 | All versions | 1.3.4-107.module_el8.5.0+2625+ec418553 |
rubygem-bson AlmaLinux:8 | All versions | 4.3.0-2.module_el8.5.0+259+8cec6917 |
rubygem-bson AlmaLinux:8 | All versions | 4.3.0-2.module_el8.5.0+2625+ec418553 |
rubygem-bson-doc AlmaLinux:8 | All versions | 4.3.0-2.module_el8.5.0+259+8cec6917 |
rubygem-bson-doc AlmaLinux:8 | All versions | 4.3.0-2.module_el8.5.0+2625+ec418553 |
rubygem-bundler AlmaLinux:8 | All versions | 1.16.1-4.module_el8.5.0+259+8cec6917 |
rubygem-bundler AlmaLinux:8 | All versions | 1.16.1-4.module_el8.5.0+2625+ec418553 |
rubygem-bundler-doc AlmaLinux:8 | All versions | 1.16.1-4.module_el8.5.0+259+8cec6917 |
rubygem-bundler-doc AlmaLinux:8 | All versions | 1.16.1-4.module_el8.5.0+2625+ec418553 |
rubygem-did_you_mean AlmaLinux:8 | All versions | 1.2.0-107.module_el8.5.0+2625+ec418553 |
rubygem-io-console AlmaLinux:8 | All versions | 0.4.6-107.module_el8.5.0+2625+ec418553 |
rubygem-json AlmaLinux:8 | All versions | 2.1.0-107.module_el8.5.0+2625+ec418553 |
rubygem-minitest AlmaLinux:8 | All versions | 5.10.3-107.module_el8.5.0+2625+ec418553 |
rubygem-mongo AlmaLinux:8 | All versions | 2.5.1-2.module_el8.5.0+259+8cec6917 |
rubygem-mongo AlmaLinux:8 | All versions | 2.5.1-2.module_el8.5.0+2625+ec418553 |
rubygem-mongo-doc AlmaLinux:8 | All versions | 2.5.1-2.module_el8.5.0+259+8cec6917 |
rubygem-mongo-doc AlmaLinux:8 | All versions | 2.5.1-2.module_el8.5.0+2625+ec418553 |
rubygem-mysql2 AlmaLinux:8 | All versions | 0.4.10-4.module_el8.5.0+259+8cec6917 |
rubygem-mysql2 AlmaLinux:8 | All versions | 0.4.10-4.module_el8.5.0+2625+ec418553 |
rubygem-mysql2-doc AlmaLinux:8 | All versions | 0.4.10-4.module_el8.5.0+259+8cec6917 |
rubygem-mysql2-doc AlmaLinux:8 | All versions | 0.4.10-4.module_el8.5.0+2625+ec418553 |
rubygem-net-telnet AlmaLinux:8 | All versions | 0.1.1-107.module_el8.5.0+2625+ec418553 |
rubygem-openssl AlmaLinux:8 | All versions | 2.1.2-107.module_el8.5.0+2625+ec418553 |
rubygem-pg AlmaLinux:8 | All versions | 1.0.0-2.module_el8.5.0+259+8cec6917 |
rubygem-pg AlmaLinux:8 | All versions | 1.0.0-2.module_el8.5.0+2625+ec418553 |
Products include Bundler Bundler, Fedoraproject Fedora, Microsoft Package Manager Configurations.
How do I fix CVE-2020-36327?
Upgrade bundler to a fixed version for your release line: 2.2.10 or 2.2.18.
Is CVE-2020-36327 being exploited?
There is no known exploitation of CVE-2020-36327 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
- CVE-2016-7954 Bundler allows attacker to inject arbitrary code via secondary Gem source
- CVE-2019-3881 Insecure path handling in Bundler
- CVE-2021-43809 Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile
- CVE-2013-0334 Bundler may install gems from a different source than expected
Sources
Also known as ALSA-2022:0545, DEBIAN-CVE-2020-36327, GHSA-fp4w-jxhp-m23p, OESA-2021-1258, RHSA-2022:0545, RHSA-2022:0546 and 6 more.