CVE-2016-7954

Severity CVSS v4.0:
Pending analysis
Type:
CWE-94 Code Injection
Publication date:
22/12/2016
Last modified:
12/04/2025

Description

Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2013-0334.

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:bundler:bundler:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:bundler:bundler:1.0.0:beta1:*:*:*:*:*:*
cpe:2.3:a:bundler:bundler:1.0.0:beta10:*:*:*:*:*:*
cpe:2.3:a:bundler:bundler:1.0.0:beta6:*:*:*:*:*:*
cpe:2.3:a:bundler:bundler:1.0.0:beta7:*:*:*:*:*:*
cpe:2.3:a:bundler:bundler:1.0.0:beta8:*:*:*:*:*:*
cpe:2.3:a:bundler:bundler:1.0.0:beta9:*:*:*:*:*:*
cpe:2.3:a:bundler:bundler:1.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:bundler:bundler:1.0.0:rc2:*:*:*:*:*:*
cpe:2.3:a:bundler:bundler:1.0.0:rc3:*:*:*:*:*:*
cpe:2.3:a:bundler:bundler:1.0.0:rc4:*:*:*:*:*:*
cpe:2.3:a:bundler:bundler:1.0.0:rc5:*:*:*:*:*:*
cpe:2.3:a:bundler:bundler:1.0.0:rc6:*:*:*:*:*:*
cpe:2.3:a:bundler:bundler:1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:bundler:bundler:1.0.2:*:*:*:*:*:*:*