FLAT-QPSF7 – Vulnerability | Fluid Attacks Database

Database

Description

insufficient validation

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
rubygems	bundler	>=1.16.0 <2.2.10 \|\| >=2.2.11 <2.2.18	2.2.10, 2.2.18
debian 11	rubygems	=3.2.27-1 \|\| =3.2.27-2 \|\| =3.2.27-3 \|\| =3.2.5-2 \|\| =3.2.5-2+deb11u1 \|\| =3.3.15-1 \|\| =3.3.15-2 \|\| =3.3.5-1 \|\| =3.3.5-2 \|\| =3.4.20-1 \|\| =3.4.20-1~0 \|\| =3.6.3-1 \|\| =3.6.6-1 \|\| =3.6.7-1 \|\| =3.6.7-2 \|\| =3.6.7-3~exp1	-
debian 14	rubygems	>=0 <3.3.5-1	3.3.5-1
debian 13	rubygems	>=0 <3.3.5-1	3.3.5-1
debian 12	rubygems	>=0 <3.3.5-1	3.3.5-1
rpm rhel8	ruby	<0:2.7.4-137.module+el8.4.0+12025+f744ca41	0:2.7.4-137.module+el8.4.0+12025+f744ca41
alpm rolling_release	ruby-bundler	>=2.2.17-1 <2.2.18-1	2.2.18-1

Aliases

1. CVE-2020-363272. NVD-2020-363273. OSV-2020-363274. OSV-DEBIAN-2020-363275. GCVE-2020-363276. SECURITY-TRACKER-CVE-2020-36327

References

1. https://github.com/rubygems/rubygems/issues/39822. https://github.com/rubygems/rubygems/pull/46093. https://github.com/rubygems/rubygems/commit/078bf682ac40017b309b5fc69f283ff640e7c1294. https://bundler.io/blog/2021/02/15/a-more-secure-bundler-we-fixed-our-source-priorities.html5. https://github.com/rubygems/rubygems/blob/master/bundler/CHANGELOG.md#2218-may-25-20216. https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bundler/CVE-2020-36327.yml7. https://lists.fedoraproject.org/archives/list/[email protected]/message/MWXHK5UUHVSHF7HTHMX6JY3WXDVNIHSL8. https://mensfeld.pl/2021/02/rubygems-dependency-confusion-attack-side-of-things9. https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-2410510. https://www.zofrex.com/blog/2021/04/29/bundler-still-vulnerable-dependency-confusion-cve-2020-36327

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.