Skip to content
OpenAdvisories
High RHSA-2022:0545 1 CVE

Red Hat Security Advisory: ruby:2.5 security update

Published Sep 13, 2024 · Updated Oct 9, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-bundler 0:1.16.1-4.module+el8.5.0+13840+ec418553
Red Hat · RHEL 8 enterprise_linux:8::appstream rubygem-bundler-doc 0:1.16.1-4.module+el8.5.0+13840+ec418553

Vulnerabilities 1

  • High 8.8
    CVE-2020-36327

    Dependency Confusion in Bundler

    Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a …

    rubygems bundler bundler Debian Ubuntu RubyGems

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://access.redhat.com/articles/6206172
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1958999
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0545.json
  • report
    https://access.redhat.com/security/cve/CVE-2020-36327
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-36327
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-36327
  • article
    https://www.zofrex.com/blog/2021/04/29/bundler-still-vulnerable-dependency-confusion-cve-2020-36327/