This update for rubygem-bundler fixes the following issue :

CVE-2019-3881: Fixed insecure permissions on a directory in /tmp/ that allowed malicious code execution (bsc#1143436).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202408-22 (Bundler: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Bundler. Please review the CVE identifiers referenced     below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-1768:01 advisory.

    * rubygem-bundler: Insecure permissions on directory in /tmp/ allows for execution of malicious code     (CVE-2019-3881)
      * ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)
      * ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication     (CVE-2019-16201)
      * ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)
      * rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)
      * ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)
      * ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)
      * ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)
      * ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Gitlab reports :

Ability to steal a user's API access token through GitLab Pages

Prometheus denial of service via HTTP request with custom method

Unauthorized user is able to access private repository information under specific conditions

Regular expression denial of service in NuGet API

Regular expression denial of service in package uploads

Update curl dependency

CVE-2019-3881 mitigation

An update of the rubygem package has been released.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:2588 advisory.

    * rubygem-bundler: Insecure permissions on directory in /tmp/ allows for execution of malicious code     (CVE-2019-3881)

    * ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)

    * ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication     (CVE-2019-16201)

    * ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)

    * rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)

    * ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)

    * ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

    * ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

    * ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for rubygem-bundler fixes the following issue :

  - CVE-2019-3881: Fixed insecure permissions on a directory     in /tmp/ that allowed malicious code execution     (bsc#1143436).

This update was imported from the SUSE:SLE-15:Update update project.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2588 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    The following packages have been upgraded to a later upstream version: ruby (2.6.7). (BZ#1952627)

    Security Fix(es):

    * rubygem-bundler: Insecure permissions on directory in /tmp/ allows for execution of malicious code     (CVE-2019-3881)

    * ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845)

    * ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication     (CVE-2019-16201)

    * ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255)

    * rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)

    * ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933)

    * ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613)

    * ruby: XML round-trip vulnerability in REXML (CVE-2021-28965)

    * ruby: HTTP response splitting in WEBrick (CVE-2019-16254)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Resolv::DNS: ruby:2.6/ruby: timeouts if multiple IPv6 name servers are given and address contains     leading zero [rhel-8] (BZ#1954968)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2024-005590 advisory.

    Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage     location for gems, if locations under the user's home directory are not available. If Bundler is used in a     scenario where the user does not have a writable home directory, an attacker could place malicious code in     this directory that would be later loaded and executed.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
137606	SUSE SLED15 / SLES15 Security Update : rubygem-bundler (SUSE-SU-2020:1582-1)	Nessus	SuSE Local Security Checks	6/18/2020	1/26/2022	high
205347	GLSA-202408-22 : Bundler: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	8/10/2024	8/10/2024	high
293957	MiracleLinux 7 : rh-ruby26-ruby-2.6.7-119.el7 (AXSA:2021-1768:01)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	high
144815	FreeBSD : Gitlab -- multiple vulnerabilities (a2a2b34d-52b4-11eb-87cb-001b217b3468)	Nessus	FreeBSD Local Security Checks	1/11/2021	11/4/2021	high
151947	Photon OS 4.0: Rubygem PHSA-2021-4.0-0060	Nessus	PhotonOS Local Security Checks	7/22/2021	8/23/2025	high
179413	AlmaLinux 8 : ruby:2.6 (ALSA-2021:2588)	Nessus	Alma Linux Local Security Checks	8/7/2023	1/13/2025	high
138681	openSUSE Security Update : rubygem-bundler (openSUSE-2020-803)	Nessus	SuSE Local Security Checks	7/20/2020	11/4/2021	high
138701	openSUSE Security Update : rubygem-bundler (openSUSE-2020-861)	Nessus	SuSE Local Security Checks	7/20/2020	11/4/2021	high
151143	RHEL 8 : ruby:2.6 (RHSA-2021:2588)	Nessus	Red Hat Local Security Checks	6/29/2021	1/13/2025	high
341204	Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: rubygem-bundler (UTSA-2024-005590)	Nessus	Unity Linux Local Security Checks	8/28/2026	8/28/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high