Skip to content
OpenAdvisories
High USN-4870-1 1 CVE

bundler vulnerability

Published Mar 15, 2021 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Bundler incorrectly created directories with
insecure permissions in /tmp. An attacker could write malicious libraries
to this location for later execution.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS bundler 1.16.1-1ubuntu0.1~esm1

Vulnerabilities 1

  • High 7.0
    CVE-2019-3881

    Insecure path handling in Bundler

    Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable…

    bundler bundler Ubuntu RubyGems

References

  • report
    https://ubuntu.com/security/CVE-2019-3881