CVE-2020-36327

Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.17 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application.

Bundler manages an application's dependencies through its entire life, across many machines, systematically and repeatably.

Security Fix(es):

Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every Dependency Confusion issue in every product.(CVE-2020-36327)

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

• rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source (CVE-2020-36327)

• rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799)

• ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810)

• ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

• rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source (CVE-2020-36327)

• rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799)

• ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810)

• ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)

• ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)

• ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

• rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source (CVE-2020-36327)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every "Dependency Confusion" issue in every product.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

• rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source (CVE-2020-36327)

• rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799)

• ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810)

• ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

• rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source (CVE-2020-36327)

• rubygem-rdoc: Command injection vulnerability in RDoc (CVE-2021-31799)

• ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host (CVE-2021-31810)

• ruby: StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066)

• ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)

• ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

• rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source (CVE-2020-36327)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bundler sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. (CVE-2020-36327)

The REXML gem does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing. (CVE-2021-28965)

In RDoc it is possible to execute arbitrary code via | and tags in a filename. (CVE-2021-31799)

A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions). (CVE-2021-31810)

Ruby Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack." (CVE-2021-32066)

Buffer Overrun in CGI.escape_html (CVE-2021-41816)

Regular Expression Denial of Service Vulnerability of Date Parsing Methods (CVE-2021-41817)

Cookie Prefix Spoofing in CGI::Cookie.parse (CVE-2021-41819)

Root has patched CVE-2020-36327 in the bundler package for Root:Ruby. Multiple fixed versions available.

This update for rubygem-bundler fixes the following issues:

• CVE-2020-36327: Fixed bundler choosing a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen (bsc#1185842)

Other fixes:

• Updated to version 2.2.34

This update for rubygem-bundler fixes the following issues:

Updated to version 2.2.34.

• CVE-2020-36327: Bundler chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen (bsc#1185842)

• CVE-2021-43809: rubygem-bundler: remote execution via Gemfile argument injection (bsc#1193578)