CVE-2016-7954: Code Injection

Published Oct 5, 2016
·
Updated

A vulnerability was found in Bundler. Bundler allows the user to specify sources from which Ruby gems are installed. If a secondary source is specified, even if scoped to a specific gem, that source is silently applied to all declared gems. This allows an attacker to introduce arbitrary code into an application via gem name collision on the secondary source, which will unexpectedly (and without warning) take priority over the primary source.

CVE request:

http://seclists.org/oss-sec/2016/q4/18

CVE assignment:

http://seclists.org/oss-sec/2016/q4/20

References:

http://seclists.org/oss-sec/2016/q4/25

Other sources

Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2013-0334.

— MITRE

Affected Software

184 affected componentsFixes available
Bundler Bundler=1.0.0
Bundler Bundler=1.0.0-beta1
Bundler Bundler=1.0.0-beta10
Bundler Bundler=1.0.0-beta6
Bundler Bundler=1.0.0-beta7
Bundler Bundler=1.0.0-beta8
Bundler Bundler=1.0.0-beta9
Bundler Bundler=1.0.0-rc1
Bundler Bundler=1.0.0-rc2
Bundler Bundler=1.0.0-rc3
Bundler Bundler=1.0.0-rc4
Bundler Bundler=1.0.0-rc5
Bundler Bundler=1.0.0-rc6
Bundler Bundler=1.0.1
Bundler Bundler=1.0.2
Bundler Bundler=1.0.3
Bundler Bundler=1.0.4
Bundler Bundler=1.0.5
Bundler Bundler=1.0.6
Bundler Bundler=1.0.7
Bundler Bundler=1.0.8
Bundler Bundler=1.0.9
Bundler Bundler=1.0.10
Bundler Bundler=1.0.11
Bundler Bundler=1.0.12
Bundler Bundler=1.0.13
Bundler Bundler=1.0.14
Bundler Bundler=1.0.15
Bundler Bundler=1.0.16
Bundler Bundler=1.0.17
Bundler Bundler=1.0.18
Bundler Bundler=1.0.19-rc
Bundler Bundler=1.0.20
Bundler Bundler=1.0.20-rc
Bundler Bundler=1.0.21
Bundler Bundler=1.0.21-rc
Bundler Bundler=1.1-pre
Bundler Bundler=1.1-pre1
Bundler Bundler=1.1-pre10
Bundler Bundler=1.1-pre2
Bundler Bundler=1.1-pre3
Bundler Bundler=1.1-pre4
Bundler Bundler=1.1-pre5
Bundler Bundler=1.1-pre6
Bundler Bundler=1.1-pre7
Bundler Bundler=1.1-pre8
Bundler Bundler=1.1-pre9
Bundler Bundler=1.1-rc
Bundler Bundler=1.1-rc2
Bundler Bundler=1.1-rc3
Bundler Bundler=1.1-rc4
Bundler Bundler=1.1-rc5
Bundler Bundler=1.1-rc6
Bundler Bundler=1.1-rc7
Bundler Bundler=1.1-rc8
Bundler Bundler=1.1.0
Bundler Bundler=1.1.1
Bundler Bundler=1.1.2
Bundler Bundler=1.1.3
Bundler Bundler=1.1.4
Bundler Bundler=1.1.5
Bundler Bundler=1.2.0
Bundler Bundler=1.2.0-pre
Bundler Bundler=1.2.0-pre1
Bundler Bundler=1.2.0-rc
Bundler Bundler=1.2.0-rc2
Bundler Bundler=1.2.1
Bundler Bundler=1.2.2
Bundler Bundler=1.2.3
Bundler Bundler=1.2.4
Bundler Bundler=1.2.5
Bundler Bundler=1.3.0
Bundler Bundler=1.3.0-pre
Bundler Bundler=1.3.0-pre2
Bundler Bundler=1.3.0-pre3
Bundler Bundler=1.3.0-pre4
Bundler Bundler=1.3.0-pre5
Bundler Bundler=1.3.0-pre6
Bundler Bundler=1.3.0-pre7
Bundler Bundler=1.3.0-pre8
Bundler Bundler=1.3.1
Bundler Bundler=1.3.2
Bundler Bundler=1.3.3
Bundler Bundler=1.3.4
Bundler Bundler=1.3.5
Bundler Bundler=1.3.6
Bundler Bundler=1.4.0-pre1
Bundler Bundler=1.4.0-rc1
Bundler Bundler=1.5.0
Bundler Bundler=1.5.0-rc1
Bundler Bundler=1.5.0-rc2
Bundler Bundler=1.5.1
Bundler Bundler=1.5.2
Bundler Bundler=1.5.3
Bundler Bundler=1.6.0
Bundler Bundler=1.6.1
Bundler Bundler=1.6.2
Bundler Bundler=1.6.3
Bundler Bundler=1.6.4
Bundler Bundler=1.6.5
Bundler Bundler=1.6.6
Bundler Bundler=1.6.7
Bundler Bundler=1.7.0
Bundler Bundler=1.7.1
Bundler Bundler=1.7.2
Bundler Bundler=1.7.3
Bundler Bundler=1.7.4
Bundler Bundler=1.7.5
Bundler Bundler=1.7.6
Bundler Bundler=1.7.7
Bundler Bundler=1.7.8
Bundler Bundler=1.7.9
Bundler Bundler=1.7.10
Bundler Bundler=1.7.11
Bundler Bundler=1.7.12
Bundler Bundler=1.7.13
Bundler Bundler=1.7.14
Bundler Bundler=1.7.15
Bundler Bundler=1.8.0
Bundler Bundler=1.8.0-pre
Bundler Bundler=1.8.0-rc
Bundler Bundler=1.8.1
Bundler Bundler=1.8.2
Bundler Bundler=1.8.3
Bundler Bundler=1.8.4
Bundler Bundler=1.8.5
Bundler Bundler=1.8.6
Bundler Bundler=1.8.7
Bundler Bundler=1.8.8
Bundler Bundler=1.8.9
Bundler Bundler=1.9.0
Bundler Bundler=1.9.0-pre
Bundler Bundler=1.9.0-pre1
Bundler Bundler=1.9.0-rc
Bundler Bundler=1.9.1
Bundler Bundler=1.9.2
Bundler Bundler=1.9.3
Bundler Bundler=1.9.4
Bundler Bundler=1.9.5
Bundler Bundler=1.9.6
Bundler Bundler=1.9.7
Bundler Bundler=1.9.8
Bundler Bundler=1.9.9
Bundler Bundler=1.9.10
Bundler Bundler=1.10.0
Bundler Bundler=1.10.0-pre
Bundler Bundler=1.10.0-pre1
Bundler Bundler=1.10.0-pre2
Bundler Bundler=1.10.0-rc
Bundler Bundler=1.10.1
Bundler Bundler=1.10.2
Bundler Bundler=1.10.3
Bundler Bundler=1.10.4
Bundler Bundler=1.10.5
Bundler Bundler=1.10.6
Bundler Bundler=1.11.0
Bundler Bundler=1.11.0-pre1
Bundler Bundler=1.11.0-pre2
Bundler Bundler=1.11.1
Bundler Bundler=1.11.2
Bundler Bundler=1.12.0
Bundler Bundler=1.12.0-pre1
Bundler Bundler=1.12.0-pre2
Bundler Bundler=1.12.0-rc
Bundler Bundler=1.12.0-rc2
Bundler Bundler=1.12.0-rc3
Bundler Bundler=1.12.0-rc4
Bundler Bundler=1.12.1
Bundler Bundler=1.12.2
Bundler Bundler=1.12.3
Bundler Bundler=1.12.4
Bundler Bundler=1.12.5
Bundler Bundler=1.12.6
Bundler Bundler=1.13.0
Bundler Bundler=1.13.0-pre1
Bundler Bundler=1.13.0-rc1
Bundler Bundler=1.13.0-rc2
Bundler Bundler=1.13.1
Bundler Bundler=1.13.2
Bundler Bundler=1.13.3
Bundler Bundler=1.13.4
Bundler Bundler=1.13.5
Bundler Bundler=1.13.6
rubygems/bundler>=1.0.0<2.0.0
2.0.0

Remediation

Patch Available

https://github.com/bundler/bundler/issues/5051

Patch Available

https://github.com/bundler/bundler/issues/5062

Event History

Oct 5, 2016
Data Sourced
via Red Hat·12:19 PM
DescriptionSeverityAffected Software
Dec 22, 2016
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
Description
May 14, 2022
Advisory Published
via GitHub·12:57 AM
Data Sourced
via GitHub·12:57 AM
DescriptionSeverityWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2016-7954?

The severity of CVE-2016-7954 is classified as high due to the risk of arbitrary code execution.

2

How do I fix CVE-2016-7954?

To fix CVE-2016-7954, upgrade Bundler to version 1.10.6 or later.

3

What systems are affected by CVE-2016-7954?

CVE-2016-7954 affects Bundler versions from 1.0.0 through 1.10.5.

4

What type of vulnerability is CVE-2016-7954?

CVE-2016-7954 is a dependency confusion vulnerability that allows for code injection.

5

Is there a workaround for CVE-2016-7954?

A recommended workaround for CVE-2016-7954 is to avoid using multiple gem sources until the vulnerability is patched.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203