CVE-2020-36327

Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every "Dependency Confusion" issue in every product.

References

Affected packages

Git / github.com/rubygems/rubygems

Affected ranges

Type

GIT

Repo

https://github.com/rubygems/rubygems

Events

Introduced

10f20fa33bc36371cbad00106487c6eb22616ec7

Fixed

cc7c3337218989b3a6aad3910eb4f9c74cdd4f56

Introduced

6ca677a0eb8f985235d67563fc0f978ef77d7bad

Last affected

3d7bfaff250cfee48b44985f696dc172a9cdc65d

Database specific

{
    "versions": [
        {
            "introduced": "1.16.0"
        },
        {
            "fixed": "2.2.10"
        },
        {
            "introduced": "2.2.11"
        },
        {
            "last_affected": "2.2.16"
        }
    ]
}

Affected versions

bundler-v2.*

bundler-v2.2.11

v3.*

v3.2.11

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-36327.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "34"
            }
        ]
    }
]