NVD

Id
21976  
Name
CVE-2016-7954  
Description
Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2013-0334.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2016-12-22  
Modified Date
2016-12-23  
Seq
2016-7954  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
117765 21976 CVE-2016-7954 http://collectiveidea.com/blog/archives/2016/10/06/bundlers-multiple-source-security-vulnerability/  View
117766 21976 CVE-2016-7954 [oss-security] 20161004 Re: Re: CVE request for code execution via gem name collission in bundler (was Re: CVE Request)  View
117767 21976 CVE-2016-7954 [oss-security] 20161004 Re: CVE request for code execution via gem name collission in bundler (was Re: CVE Request)  View
117768 21976 CVE-2016-7954 [oss-security] 20161004 Re: Re: CVE request for code execution via gem name collission in bundler (was Re: CVE Request)  View
117769 21976 CVE-2016-7954 93423  View
117770 21976 CVE-2016-7954 https://bugzilla.redhat.com/show_bug.cgi?id=1381951  View
117771 21976 CVE-2016-7954 https://github.com/bundler/bundler/issues/5051  View
117772 21976 CVE-2016-7954 https://github.com/bundler/bundler/issues/5062  View

Related JVN