{"id":"CVE-2019-3881","aliases":["ALSA-2021:2588","EUVD-2021-1077","GHSA-g98m-96g9-wfjq","OESA-2021-1419","RHSA-2021:2230","RHSA-2021:2588","RLSA-2021:2588","SUSE-SU-2020:1582-1","SUSE-SU-2020:1582-2","UBUNTU-CVE-2019-3881","USN-4870-1","openSUSE-SU-2020:0803-1","openSUSE-SU-2020:0861-1"],"status":"published","title":"Insecure path handling in Bundler","description":"Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00529,"percentile":0.45026,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-427","CWE-552"],"published":"2020-06-09T16:20:16Z","modified":"2026-11-02T09:30:02Z","fixes":[{"ecosystem":"RubyGems","package":"bundler","fixed_in":["2.1.0"],"sources":["ghsa","osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"rubygem-bundler","fixed_in":["2.2.19-1.oe1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"rubygem-bundler","fixed_in":["1.16.1-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"rubygem-bundler","fixed_in":["1.16.1-3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"bundler","fixed_in":["1.16.1-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"rubygem-bundler","fixed_in":["1.16.1-lp151.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"rubygem-bundler","fixed_in":["1.16.1-lp152.4.3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.14.0"},{"fixed":"2.1.0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-abrt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.0-4.module_el8.5.0+259+8cec6917"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-abrt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.0-4.module_el8.5.0+2623+08a8ba32"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-abrt-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.0-4.module_el8.5.0+259+8cec6917"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-abrt-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.0-4.module_el8.5.0+2623+08a8ba32"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-bson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0-1.module_el8.5.0+2623+08a8ba32"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-bson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0-1.module_el8.5.0+250+ba22dbf7"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-bson-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0-1.module_el8.5.0+250+ba22dbf7"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-bson-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0-1.module_el8.5.0+2623+08a8ba32"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-mongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.0-1.module_el8.5.0+250+ba22dbf7"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-mongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.0-1.module_el8.5.0+2623+08a8ba32"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-mongo-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.0-1.module_el8.5.0+250+ba22dbf7"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-mongo-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.0-1.module_el8.5.0+2623+08a8ba32"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-1.module_el8.5.0+250+ba22dbf7"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-1.module_el8.5.0+2623+08a8ba32"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-mysql2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-1.module_el8.5.0+250+ba22dbf7"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-mysql2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.2-1.module_el8.5.0+2623+08a8ba32"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.4-1.module_el8.5.0+250+ba22dbf7"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.4-1.module_el8.5.0+2623+08a8ba32"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-pg-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.4-1.module_el8.5.0+2623+08a8ba32"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-pg-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.4-1.module_el8.5.0+250+ba22dbf7"}]}],"bundled":9},{"source":"osv","ecosystem":"RubyGems","package":"bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.14.0"},{"fixed":"2.1.0"}]}],"versions":["1.14.0","1.14.1","1.14.2","1.14.3","1.14.4","1.14.5","1.14.6","1.15.0","1.15.0.pre.1","1.15.0.pre.2","1.15.0.pre.3","1.15.0.pre.4","1.15.1","1.15.2","1.15.3","1.15.4","1.16.0","1.16.0.pre.1","1.16.0.pre.2","1.16.0.pre.3","1.16.1","1.16.2","1.16.3","1.16.4","1.16.5","1.16.6","1.17.0","1.17.0.pre.1","1.17.0.pre.2","1.17.1","1.17.2","1.17.3","2.0.0","2.0.0.pre.1","2.0.0.pre.2","2.0.0.pre.3","2.0.1","2.0.2","2.1.0.pre.1","2.1.0.pre.2","2.1.0.pre.3"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.19-1.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby26-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.7-119.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby26-ruby-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.7-119.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby26-ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.7-119.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby26-ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.7-119.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby26-ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.7-119.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby26-rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-119.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby26-rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.2-119.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby26-rubygem-did_you_mean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.0-119.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby26-rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.7-119.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby26-rubygem-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-119.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby26-rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-119.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby26-rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.11.3-119.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby26-rubygem-net-telnet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.0-119.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby26-rubygem-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.2-119.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby26-rubygem-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.3-119.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby26-rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.0-119.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby26-rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.3-119.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby26-rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.2-119.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby26-rubygem-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.9-119.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby26-rubygem-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-119.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby26-rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3.1-119.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby26-rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3.1-119.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.7-107.module+el8.4.0+10830+bbd85cce"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.7-107.module+el8.4.0+10830+bbd85cce"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.7-107.module+el8.4.0+10830+bbd85cce"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.7-107.module+el8.4.0+10830+bbd85cce"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.7-107.module+el8.4.0+10830+bbd85cce"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.7-107.module+el8.4.0+10830+bbd85cce"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.7-107.module+el8.4.0+10830+bbd85cce"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-abrt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-4.module+el8.1.0+3653+beb38eb0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-abrt-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-4.module+el8.1.0+3653+beb38eb0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-107.module+el8.4.0+10830+bbd85cce"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-bigdecimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-107.module+el8.4.0+10830+bbd85cce"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-bson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0-1.module+el8.1.0+3653+beb38eb0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-bson-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0-1.module+el8.1.0+3653+beb38eb0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-bson-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0-1.module+el8.1.0+3653+beb38eb0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-bson-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0-1.module+el8.1.0+3653+beb38eb0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.2-107.module+el8.4.0+10830+bbd85cce"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-did_you_mean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.0-107.module+el8.4.0+10830+bbd85cce"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.7-107.module+el8.4.0+10830+bbd85cce"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-io-console-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.7-107.module+el8.4.0+10830+bbd85cce"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-107.module+el8.4.0+10830+bbd85cce"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-107.module+el8.4.0+10830+bbd85cce"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-json-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-107.module+el8.4.0+10830+bbd85cce"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.11.3-107.module+el8.4.0+10830+bbd85cce"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-mongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.0-1.module+el8.1.0+3653+beb38eb0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-mongo-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.0-1.module+el8.1.0+3653+beb38eb0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.2-1.module+el8.1.0+3653+beb38eb0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-mysql2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.2-1.module+el8.1.0+3653+beb38eb0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-mysql2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.2-1.module+el8.1.0+3653+beb38eb0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-mysql2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.2-1.module+el8.1.0+3653+beb38eb0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-net-telnet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.0-107.module+el8.4.0+10830+bbd85cce"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.2-107.module+el8.4.0+10830+bbd85cce"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.2-107.module+el8.4.0+10830+bbd85cce"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.4-1.module+el8.1.0+3653+beb38eb0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-pg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.4-1.module+el8.1.0+3653+beb38eb0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-pg-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.4-1.module+el8.1.0+3653+beb38eb0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-pg-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.4-1.module+el8.1.0+3653+beb38eb0"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.3-107.module+el8.4.0+10830+bbd85cce"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.0-107.module+el8.4.0+10830+bbd85cce"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-psych-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.0-107.module+el8.4.0+10830+bbd85cce"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.3-107.module+el8.4.0+10830+bbd85cce"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.2-107.module+el8.4.0+10830+bbd85cce"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.9-107.module+el8.4.0+10830+bbd85cce"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-107.module+el8.4.0+10830+bbd85cce"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3.1-107.module+el8.4.0+10830+bbd85cce"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.3.1-107.module+el8.4.0+10830+bbd85cce"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.7-107.module+el8.4.0+593+8d7f9f0c"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-abrt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-4.module+el8.5.0+738+032c9c02"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-abrt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-4.module+el8.3.0+167+5c390590"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-abrt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-4.module+el8.4.0+592+03ff458a"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-bson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0-1.module+el8.4.0+593+8d7f9f0c"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-bson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0-1.module+el8.4.0+446+80b53620"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-mongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.0-1.module+el8.4.0+593+8d7f9f0c"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-mongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.0-1.module+el8.4.0+446+80b53620"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.2-1.module+el8.5.0+738+032c9c02"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.2-1.module+el8.4.0+446+80b53620"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.2-1.module+el8.4.0+593+8d7f9f0c"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.4-1.module+el8.5.0+738+032c9c02"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.4-1.module+el8.4.0+446+80b53620"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.4-1.module+el8.4.0+593+8d7f9f0c"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-1ubuntu0.1~esm1"}]}],"versions":["1.15.1-1","1.16.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-1ubuntu0.1~esm1"}]}],"versions":["1.15.1-1","1.16.1-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-lp151.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-lp152.4.3.1"}]}]}],"products":[{"vendor":"bundler","product":"bundler"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1651826","tags":["x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3881","tags":["advisory"]},{"url":"https://github.com/rubygems/bundler/issues/6501","tags":["web"]},{"url":"https://github.com/rubygems/bundler/pull/7416/commits/65cfebb041c454c246aaf32a177b0243915a9998","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g98m-96g9-wfjq","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bundler/CVE-2019-3881.yml","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2021:2588","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/1651826","tags":["report"]},{"url":"https://bugzilla.redhat.com/1773728","tags":["report"]},{"url":"https://bugzilla.redhat.com/1789407","tags":["report"]},{"url":"https://bugzilla.redhat.com/1789556","tags":["report"]},{"url":"https://bugzilla.redhat.com/1793683","tags":["report"]},{"url":"https://bugzilla.redhat.com/1827500","tags":["report"]},{"url":"https://bugzilla.redhat.com/1833291","tags":["report"]},{"url":"https://bugzilla.redhat.com/1883623","tags":["report"]},{"url":"https://bugzilla.redhat.com/1947526","tags":["report"]},{"url":"https://bugzilla.redhat.com/1952627","tags":["report"]},{"url":"https://bugzilla.redhat.com/1954968","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-2588.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2019-15845","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-16201","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-16254","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-16255","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-3881","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-10663","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-10933","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-25613","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-28965","tags":["report"]},{"url":"https://github.com/rubygems/bundler","tags":["package"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1419","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:2230","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_software_collections/3/html/3.7_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1773728","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1789407","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1789556","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1793683","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1827500","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1833291","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1883623","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1947526","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1950331","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2230.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-3881","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3881","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-15845","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-15845","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15845","tags":["advisory"]},{"url":"https://www.ruby-lang.org/en/news/2019/10/01/nul-injection-file-fnmatch-cve-2019-15845/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-16201","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-16201","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16201","tags":["advisory"]},{"url":"https://www.ruby-lang.org/en/news/2019/10/01/webrick-regexp-digestauth-dos-cve-2019-16201/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-16254","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-16254","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16254","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-16255","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-16255","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16255","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-10663","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-10663","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10663","tags":["advisory"]},{"url":"https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-10933","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-10933","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10933","tags":["advisory"]},{"url":"https://www.ruby-lang.org/en/news/2020/03/31/heap-exposure-in-socket-cve-2020-10933","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-25613","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-25613","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-25613","tags":["advisory"]},{"url":"https://www.ruby-lang.org/en/news/2020/09/29/http-request-smuggling-cve-2020-25613/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-28965","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-28965","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28965","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1952627","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1954968","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2588.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:2588","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201582-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1143436","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3881","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201582-2/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-3881","tags":["report"]},{"url":"https://salsa.debian.org/ruby-team/bundler/blob/debian/1.16.1-2/debian/patches/0006-Don-t-use-insecure-temporary-directory-as-home-direc.patch","tags":["report"]},{"url":"https://salsa.debian.org/ruby-team/bundler/blob/debian/1.16.1-2/debian/patches/0007-Remove-temporary-home-directories.patch","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4870-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3U56XYFWJQFUC3VWESPJOEOBBB2HJKIC/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IU3DNYN5YWJXEATRUZHJ6PON5T54AUV6/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-3881","description":"Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.","status":"published","published":"2020-09-04T00:00:00Z","modified":"2024-08-04T19:19:18.6Z","cwes":["CWE-427"],"updated_at":"2026-11-02T14:20:23.048861Z"}],"euvd":[{"id":"EUVD-2021-1077","description":"Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.","status":"published","published":"2020-09-04T00:00:00Z","modified":"2024-08-04T19:19:18Z","updated_at":"2026-11-03T03:06:54.362786Z"}],"ghsa":[{"id":"GHSA-g98m-96g9-wfjq","title":"Insecure path handling in Bundler","description":"Bundler prior to 2.1.0 uses a predictable path in `/tmp/`, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.","status":"published","published":"2021-05-10T14:53:59Z","modified":"2023-07-05T20:18:25Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-427","CWE-552"],"updated_at":"2026-11-02T14:36:55.91458Z"}],"nvd":[{"id":"CVE-2019-3881","description":"Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.","status":"published","published":"2020-09-04T12:15:10.387Z","modified":"2026-06-17T02:35:47.86Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T14:05:47.558959Z"}],"osv":[{"id":"CVE-2019-3881","description":"Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.","status":"published","published":"2020-09-04T12:15:10.387Z","modified":"2026-10-24T10:30:46.455177056Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.363788Z"},{"id":"GHSA-g98m-96g9-wfjq","title":"Insecure path handling in Bundler","description":"Bundler prior to 2.1.0 uses a predictable path in `/tmp/`, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.","status":"published","published":"2021-05-10T14:53:59Z","modified":"2024-02-16T08:22:47.202315Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-427","CWE-552"],"updated_at":"2026-11-02T15:46:47.472172Z"},{"id":"OESA-2021-1419","title":"rubygem-bundler security update","description":"Bundler manages an application\u0026apos;s dependencies through its entire life, across many machines, systematically and repeatably.\r\n\r\nSecurity Fix(es):\r\n\r\nBundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user\u0026apos;s home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.(CVE-2019-3881)","status":"published","published":"2021-11-05T11:04:41Z","modified":"2026-08-18T01:15:38.17887656Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2021:2230","title":"Red Hat Security Advisory: rh-ruby26-ruby security, bug fix, and enhancement update","status":"published","published":"2024-09-18T04:28:52Z","modified":"2026-08-09T10:02:40Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:2588","title":"Red Hat Security Advisory: ruby:2.6 security, bug fix, and enhancement update","status":"published","published":"2024-10-21T23:26:51Z","modified":"2026-08-09T10:02:41Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:2588","title":"Moderate: ruby:2.6 security, bug fix, and enhancement update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.\n\nThe following packages have been upgraded to a later upstream version: ruby (2.6.7). (BZ#1952627)\n\nSecurity Fix(es):\n\n* rubygem-bundler: Insecure permissions on directory in /tmp/ allows for execution of malicious code (CVE-2019-3881)\n\n* ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)\n\n* ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication (CVE-2019-16201)\n\n* ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)\n\n* rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)\n\n* ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)\n\n* ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)\n\n* ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)\n\n* ruby: HTTP response splitting in WEBrick (CVE-2019-16254)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* Resolv::DNS: ruby:2.6/ruby: timeouts if multiple IPv6 name servers are given and address contains leading zero [Rocky Linux-8] (BZ#1954968)","status":"published","published":"2021-06-29T13:58:40Z","modified":"2026-02-05T05:30:10.956147Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2019-3881","description":"Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.","status":"published","published":"2020-09-04T12:15:00Z","modified":"2026-02-04T03:50:05.75581Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"ALSA-2021:2588","title":"Moderate: ruby:2.6 security, bug fix, and enhancement update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.\n\nThe following packages have been upgraded to a later upstream version: ruby (2.6.7). (BZ#1952627)\n\nSecurity Fix(es):\n\n* rubygem-bundler: Insecure permissions on directory in /tmp/ allows for execution of malicious code (CVE-2019-3881)\n\n* ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)\n\n* ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication (CVE-2019-16201)\n\n* ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)\n\n* rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)\n\n* ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)\n\n* ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)\n\n* ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)\n\n* ruby: HTTP response splitting in WEBrick (CVE-2019-16254)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* Resolv::DNS: ruby:2.6/ruby: timeouts if multiple IPv6 name servers are given and address contains leading zero [almalinux-8] (BZ#1954968)","status":"published","published":"2021-06-29T13:58:40Z","modified":"2026-11-02T09:30:02.557425394Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"openSUSE-SU-2020:0803-1","title":"Security update for rubygem-bundler","description":"This update for rubygem-bundler fixes the following issue:\n\n- CVE-2019-3881: Fixed insecure permissions on a directory in /tmp/ that allowed malicious code execution (bsc#1143436).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-06-12T22:17:33Z","modified":"2026-02-04T03:39:09.613423Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2020:0861-1","title":"Security update for rubygem-bundler","description":"This update for rubygem-bundler fixes the following issue:\n\n- CVE-2019-3881: Fixed insecure permissions on a directory in /tmp/ that allowed malicious code execution (bsc#1143436).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-06-24T16:42:43Z","modified":"2025-05-07T18:11:05.160095Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"SUSE-SU-2020:1582-1","title":"Security update for rubygem-bundler","description":"This update for rubygem-bundler fixes the following issue:\n\n- CVE-2019-3881: Fixed insecure permissions on a directory in /tmp/ that allowed malicious code execution (bsc#1143436).\n","status":"published","published":"2020-06-09T16:20:16Z","modified":"2026-02-04T03:07:32.704979Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1582-2","title":"Security update for rubygem-bundler","description":"This update for rubygem-bundler fixes the following issue:\n\n- CVE-2019-3881: Fixed insecure permissions on a directory in /tmp/ that allowed malicious code execution (bsc#1143436).\n","status":"published","published":"2020-07-15T08:57:32Z","modified":"2026-02-04T03:38:53.537985Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"USN-4870-1","title":"bundler vulnerability","description":"It was discovered that Bundler incorrectly created directories with\ninsecure permissions in /tmp. An attacker could write malicious libraries\nto this location for later execution.","status":"published","published":"2021-03-15T22:59:20Z","modified":"2026-02-10T04:42:06Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}