CVE-2019-3881: High severity Bundler Bundler Ruby vulnerability
Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.
Other sources
Bundler through version 1.17.1 creates a directory with insecure permissions in /tmp/ that, in certain circumstances, is used by Bundler to load rubygems, allowing attackers to write malicious libraries to this location and be later executed.
Bundler contains some helper code which creates a temporary directory in case a user's home directory is not present or writeable, however it creates it via non-randomized path, /tmp/bundler/home/username. Permissions for this directory are 0777 which allows an attacker to create subdirectory with an arbitrary username. Bundler processes started under an effective user without a home directory will load rubygems from this attacker-writable location, allowing for code execution.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-ruby26-rubyto a version that resolves this vulnerability.Fixed in 0:2.6.7-119.el7 - Upgrade
Upgrade
redhat/bundlerto a version that resolves this vulnerability.Fixed in 2.1.0 - Upgrade
Upgrade
bundlerto a version that resolves this vulnerability.Fixed in 2.1.0 - Upgrade
Upgrade
bundlerto a version that resolves this vulnerability.Fixed in 1.17.1 - Compensating control
If Bundler is used for an account without a writable home directory, prevent untrusted users/processes from writing to the attacker-writable temporary gem location under /tmp (e.g., ensure appropriate filesystem permissions/ownership or isolation so paths like /tmp/bundler/home/username are not writable by attackers).
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-3881?
CVE-2019-3881 has a medium severity due to the potential for unauthorized access to sensitive data.
How do I fix CVE-2019-3881?
To fix CVE-2019-3881, upgrade Bundler to version 2.1.0 or later.
What software is affected by CVE-2019-3881?
CVE-2019-3881 affects Bundler versions prior to 2.1.0 and certain versions of the rh-ruby26-ruby package.
How does CVE-2019-3881 impact security?
CVE-2019-3881 allows attackers to exploit predictable paths in insecure temporary storage locations, potentially compromising gem integrity.
Is CVE-2019-3881 a local or remote vulnerability?
CVE-2019-3881 is classified as a local vulnerability since it requires local access to the system to exploit.