CVE-2020-36327: High severity Bundler Bundler Ruby vulnerability
A flaw was found in the way Bundler determined the source repository when installing dependencies of source-restricted gem packages. In configurations that use multiple gem repositories and explicitly define from which source repository certain gems are to be installed, a dependency of a source-restricted gem could be installed form a different source if that repository provided higher version of the package. This could lead to installation of a malicious gem version and arbitrary code execution.
Other sources
Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every "Dependency Confusion" issue in every product.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-ruby27-rubyto a version that resolves this vulnerability.Fixed in 0:2.7.4-130.el7 - Upgrade
Upgrade
redhat/rh-ruby30-rubyto a version that resolves this vulnerability.Fixed in 0:3.0.2-148.el7 - Upgrade
Upgrade
redhat/rh-ruby26-rubyto a version that resolves this vulnerability.Fixed in 0:2.6.9-120.el7 - Upgrade
Upgrade
redhat/rubygem-bundlerto a version that resolves this vulnerability.Fixed in 2.2.18 - Configuration
Avoid Bundler configurations with multiple gem source repositories.
Bundler (Gemfile) source repositories = use a single source repository - Configuration
In the Gemfile configuration, explicitly define the source repository for all dependency gems.
Bundler (Gemfile) Gemfile dependency source = explicitly define source for all dependency gems - Configuration
For any internal private gem, reserve the same name in any public gem repository used (e.g., RubyGems.org) to prevent attackers from registering those names and providing malicious higher versions.
Bundler/RubyGems internal/private gem name reservation = reserved in public repositories - Configuration
If a dependency of a source-restricted gem is also to be installed from the same source, list that dependency explicitly in the Gemfile and include the specific source for it.
Bundler (Gemfile) explicit source listing for dependencies = list dependencies explicitly with the specific source - Configuration
When preparing a mirror, ensure that no mirrored gems have names conflicting with names of the internal non-public gems.
Private gem mirror/repository mirrored gem naming conflicts = no mirrored gems with conflicting names - Compensating control
If using a private repository for non-public gems, mirror any required public content (such as from RubyGems.org) into the same private repository, and do not mix repositories for dependent resolution.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-36327?
CVE-2020-36327 is considered to be a medium severity vulnerability due to its potential impact on dependency confusion.
How do I fix CVE-2020-36327?
To fix CVE-2020-36327, you should upgrade to Bundler version 2.2.18 or later and ensure that affected Ruby versions are patched appropriately.
Which systems are affected by CVE-2020-36327?
CVE-2020-36327 affects systems using Bundler versions between 1.16.0 and 2.2.10, and specific versions of rh-ruby packages.
What types of installations are impacted by CVE-2020-36327?
CVE-2020-36327 primarily impacts installations utilizing multiple gem repositories with source-restricted gem packages.
Is CVE-2020-36327 a remote code execution vulnerability?
CVE-2020-36327 does not directly lead to remote code execution but can expose systems to potential dependency confusion attacks.