CVE-2016-7954

Exploit

EPSS 8.48%
Veröffentlicht 22.12.2016 22:59:00
Zuletzt bearbeitet 06.05.2026 22:30:45
Erkennungen
Login

Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source.  NOTE: this might overlap CVE-2013-0334.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 11

NVD 183 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Bundler ≫ Bundler Version 1.0.0

Bundler ≫ Bundler Version 1.0.0 Update beta1

Bundler ≫ Bundler Version 1.0.0 Update beta10

Bundler ≫ Bundler Version 1.0.0 Update beta6

Bundler ≫ Bundler Version 1.0.0 Update beta7

Bundler ≫ Bundler Version 1.0.0 Update beta8

Bundler ≫ Bundler Version 1.0.0 Update beta9

Bundler ≫ Bundler Version 1.0.0 Update rc1

Bundler ≫ Bundler Version 1.0.0 Update rc2

Bundler ≫ Bundler Version 1.0.0 Update rc3

Bundler ≫ Bundler Version 1.0.0 Update rc4

Bundler ≫ Bundler Version 1.0.0 Update rc5

Bundler ≫ Bundler Version 1.0.0 Update rc6

Bundler ≫ Bundler Version 1.0.1

Bundler ≫ Bundler Version 1.0.2

Bundler ≫ Bundler Version 1.0.3

Bundler ≫ Bundler Version 1.0.4

Bundler ≫ Bundler Version 1.0.5

Bundler ≫ Bundler Version 1.0.6

Bundler ≫ Bundler Version 1.0.7

Bundler ≫ Bundler Version 1.0.8

Bundler ≫ Bundler Version 1.0.9

Bundler ≫ Bundler Version 1.0.10

Bundler ≫ Bundler Version 1.0.11

Bundler ≫ Bundler Version 1.0.12

Bundler ≫ Bundler Version 1.0.13

Bundler ≫ Bundler Version 1.0.14

Bundler ≫ Bundler Version 1.0.15

Bundler ≫ Bundler Version 1.0.16

Bundler ≫ Bundler Version 1.0.17

Bundler ≫ Bundler Version 1.0.18

Bundler ≫ Bundler Version 1.0.19 Update rc

Bundler ≫ Bundler Version 1.0.20

Bundler ≫ Bundler Version 1.0.20 Update rc

Bundler ≫ Bundler Version 1.0.21

Bundler ≫ Bundler Version 1.0.21 Update rc

Bundler ≫ Bundler Version 1.1 Update pre

Bundler ≫ Bundler Version 1.1 Update pre1

Bundler ≫ Bundler Version 1.1 Update pre10

Bundler ≫ Bundler Version 1.1 Update pre2

Bundler ≫ Bundler Version 1.1 Update pre3

Bundler ≫ Bundler Version 1.1 Update pre4

Bundler ≫ Bundler Version 1.1 Update pre5

Bundler ≫ Bundler Version 1.1 Update pre6

Bundler ≫ Bundler Version 1.1 Update pre7

Bundler ≫ Bundler Version 1.1 Update pre8

Bundler ≫ Bundler Version 1.1 Update pre9

Bundler ≫ Bundler Version 1.1 Update rc

Bundler ≫ Bundler Version 1.1 Update rc2

Bundler ≫ Bundler Version 1.1 Update rc3

Bundler ≫ Bundler Version 1.1 Update rc4

Bundler ≫ Bundler Version 1.1 Update rc5

Bundler ≫ Bundler Version 1.1 Update rc6

Bundler ≫ Bundler Version 1.1 Update rc7

Bundler ≫ Bundler Version 1.1 Update rc8

Bundler ≫ Bundler Version 1.1.0

Bundler ≫ Bundler Version 1.1.1

Bundler ≫ Bundler Version 1.1.2

Bundler ≫ Bundler Version 1.1.3

Bundler ≫ Bundler Version 1.1.4

Bundler ≫ Bundler Version 1.1.5

Bundler ≫ Bundler Version 1.2.0

Bundler ≫ Bundler Version 1.2.0 Update pre

Bundler ≫ Bundler Version 1.2.0 Update pre1

Bundler ≫ Bundler Version 1.2.0 Update rc

Bundler ≫ Bundler Version 1.2.0 Update rc2

Bundler ≫ Bundler Version 1.2.1

Bundler ≫ Bundler Version 1.2.2

Bundler ≫ Bundler Version 1.2.3

Bundler ≫ Bundler Version 1.2.4

Bundler ≫ Bundler Version 1.2.5

Bundler ≫ Bundler Version 1.3.0

Bundler ≫ Bundler Version 1.3.0 Update pre

Bundler ≫ Bundler Version 1.3.0 Update pre2

Bundler ≫ Bundler Version 1.3.0 Update pre3

Bundler ≫ Bundler Version 1.3.0 Update pre4

Bundler ≫ Bundler Version 1.3.0 Update pre5

Bundler ≫ Bundler Version 1.3.0 Update pre6

Bundler ≫ Bundler Version 1.3.0 Update pre7

Bundler ≫ Bundler Version 1.3.0 Update pre8

Bundler ≫ Bundler Version 1.3.1

Bundler ≫ Bundler Version 1.3.2

Bundler ≫ Bundler Version 1.3.3

Bundler ≫ Bundler Version 1.3.4

Bundler ≫ Bundler Version 1.3.5

Bundler ≫ Bundler Version 1.3.6

Bundler ≫ Bundler Version 1.4.0 Update pre1

Bundler ≫ Bundler Version 1.4.0 Update rc1

Bundler ≫ Bundler Version 1.5.0

Bundler ≫ Bundler Version 1.5.0 Update rc1

Bundler ≫ Bundler Version 1.5.0 Update rc2

Bundler ≫ Bundler Version 1.5.1

Bundler ≫ Bundler Version 1.5.2

Bundler ≫ Bundler Version 1.5.3

Bundler ≫ Bundler Version 1.6.0

Bundler ≫ Bundler Version 1.6.1

Bundler ≫ Bundler Version 1.6.2

Bundler ≫ Bundler Version 1.6.3

Bundler ≫ Bundler Version 1.6.4

Bundler ≫ Bundler Version 1.6.5

Bundler ≫ Bundler Version 1.6.6

Bundler ≫ Bundler Version 1.6.7

Bundler ≫ Bundler Version 1.7.0

Bundler ≫ Bundler Version 1.7.1

Bundler ≫ Bundler Version 1.7.2

Bundler ≫ Bundler Version 1.7.3

Bundler ≫ Bundler Version 1.7.4

Bundler ≫ Bundler Version 1.7.5

Bundler ≫ Bundler Version 1.7.6

Bundler ≫ Bundler Version 1.7.7

Bundler ≫ Bundler Version 1.7.8

Bundler ≫ Bundler Version 1.7.9

Bundler ≫ Bundler Version 1.7.10

Bundler ≫ Bundler Version 1.7.11

Bundler ≫ Bundler Version 1.7.12

Bundler ≫ Bundler Version 1.7.13

Bundler ≫ Bundler Version 1.7.14

Bundler ≫ Bundler Version 1.7.15

Bundler ≫ Bundler Version 1.8.0

Bundler ≫ Bundler Version 1.8.0 Update pre

Bundler ≫ Bundler Version 1.8.0 Update rc

Bundler ≫ Bundler Version 1.8.1

Bundler ≫ Bundler Version 1.8.2

Bundler ≫ Bundler Version 1.8.3

Bundler ≫ Bundler Version 1.8.4

Bundler ≫ Bundler Version 1.8.5

Bundler ≫ Bundler Version 1.8.6

Bundler ≫ Bundler Version 1.8.7

Bundler ≫ Bundler Version 1.8.8

Bundler ≫ Bundler Version 1.8.9

Bundler ≫ Bundler Version 1.9.0

Bundler ≫ Bundler Version 1.9.0 Update pre

Bundler ≫ Bundler Version 1.9.0 Update pre1

Bundler ≫ Bundler Version 1.9.0 Update rc

Bundler ≫ Bundler Version 1.9.1

Bundler ≫ Bundler Version 1.9.2

Bundler ≫ Bundler Version 1.9.3

Bundler ≫ Bundler Version 1.9.4

Bundler ≫ Bundler Version 1.9.5

Bundler ≫ Bundler Version 1.9.6

Bundler ≫ Bundler Version 1.9.7

Bundler ≫ Bundler Version 1.9.8

Bundler ≫ Bundler Version 1.9.9

Bundler ≫ Bundler Version 1.9.10

Bundler ≫ Bundler Version 1.10.0

Bundler ≫ Bundler Version 1.10.0 Update pre

Bundler ≫ Bundler Version 1.10.0 Update pre1

Bundler ≫ Bundler Version 1.10.0 Update pre2

Bundler ≫ Bundler Version 1.10.0 Update rc

Bundler ≫ Bundler Version 1.10.1

Bundler ≫ Bundler Version 1.10.2

Bundler ≫ Bundler Version 1.10.3

Bundler ≫ Bundler Version 1.10.4

Bundler ≫ Bundler Version 1.10.5

Bundler ≫ Bundler Version 1.10.6

Bundler ≫ Bundler Version 1.11.0

Bundler ≫ Bundler Version 1.11.0 Update pre1

Bundler ≫ Bundler Version 1.11.0 Update pre2

Bundler ≫ Bundler Version 1.11.1

Bundler ≫ Bundler Version 1.11.2

Bundler ≫ Bundler Version 1.12.0

Bundler ≫ Bundler Version 1.12.0 Update pre1

Bundler ≫ Bundler Version 1.12.0 Update pre2

Bundler ≫ Bundler Version 1.12.0 Update rc

Bundler ≫ Bundler Version 1.12.0 Update rc2

Bundler ≫ Bundler Version 1.12.0 Update rc3

Bundler ≫ Bundler Version 1.12.0 Update rc4

Bundler ≫ Bundler Version 1.12.1

Bundler ≫ Bundler Version 1.12.2

Bundler ≫ Bundler Version 1.12.3

Bundler ≫ Bundler Version 1.12.4

Bundler ≫ Bundler Version 1.12.5

Bundler ≫ Bundler Version 1.12.6

Bundler ≫ Bundler Version 1.13.0

Bundler ≫ Bundler Version 1.13.0 Update pre1

Bundler ≫ Bundler Version 1.13.0 Update rc1

Bundler ≫ Bundler Version 1.13.0 Update rc2

Bundler ≫ Bundler Version 1.13.1

Bundler ≫ Bundler Version 1.13.2

Bundler ≫ Bundler Version 1.13.3

Bundler ≫ Bundler Version 1.13.4

Bundler ≫ Bundler Version 1.13.5

Bundler ≫ Bundler Version 1.13.6

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	8.48%	0.944

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	9.8	3.9	5.9	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P

CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

http://collectiveidea.com/blog/archives/2016/10/06/bundlers-multiple-source-security-vulnerability/

Third Party Advisory

Exploit

http://www.openwall.com/lists/oss-security/2016/10/04/5

Third Party Advisory

Mailing List

http://www.openwall.com/lists/oss-security/2016/10/04/7

Third Party Advisory

Mailing List

http://www.openwall.com/lists/oss-security/2016/10/05/3

Third Party Advisory

Mailing List

http://www.securityfocus.com/bid/93423

Third Party Advisory

VDB Entry

https://bugzilla.redhat.com/show_bug.cgi?id=1381951

Issue Tracking

https://github.com/bundler/bundler/issues/5051

Patch

Third Party Advisory

Issue Tracking

https://github.com/bundler/bundler/issues/5062

Patch

Third Party Advisory

Issue Tracking

https://nvd.nist.gov/vuln/detail/CVE-2016-7954

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2016-7954

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2016-7954

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2016-7954