Read the docs
TI-2020-18610 Aliases CVE-2020-36327GHSA-fp4w-jxhp-m23p

Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency…

Priority MEDIUM 49Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 9 fixed, 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every "Dependency Confusion" issue in every product.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.06307 93rd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial bundler (RubyGems): 2.2.10, 2.2.18Red Hat: 12 advisoriesRed Hat: 9 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—bundler (RubyGems)1.16.0 to before 2.2.102.2.10Patch availableGHSA-fp4w-jxhp-m23p
—bundler (RubyGems)2.2.11 to before 2.2.182.2.18Patch availableGHSA-fp4w-jxhp-m23p
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • bundler (RubyGems) Vendor— Affected 1.16.0 to before 2.2.10 Fixed in 2.2.10 Patch available GHSA-fp4w-jxhp-m23p
  • bundler (RubyGems) Vendor— Affected 2.2.11 to before 2.2.18 Fixed in 2.2.18 Patch available GHSA-fp4w-jxhp-m23p

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:bundler:bundler:*:*:*:*:*:ruby:*:*1.16.0 to before 2.2.10; 2.2.11 – 2.2.16VulnerableBundler
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*34VulnerableFedoraproject
cpe:2.3:a:microsoft:package_manager_configurations:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
  • cpe:2.3:a:bundler:bundler:*:*:*:*:*:ruby:*:* Versions 1.16.0 to before 2.2.10; 2.2.11 – 2.2.16 Vulnerable ·Bundler
  • cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
  • cpe:2.3:a:microsoft:package_manager_configurations:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft

Remediation

  • Fix · GHSA-fp4w-jxhp-m23p bundler (RubyGems) Fixed in 2.2.10 Advisory →
  • Fix · GHSA-fp4w-jxhp-m23p bundler (RubyGems) Fixed in 2.2.18 Advisory →

Red Hat 12 advisories

  • RHSA-2022:0708 Released 2022-02-28 · Red Hat rating Important
    rh-ruby26-ruby security, bug fix, and enhancement update
    • Red Hat Software Collections for RHEL Workstation(v. 7) rh-ruby26-ruby-2.6.9-120.el7, rh-ruby26-ruby-devel-2.6.9-120.el7, rh-ruby26-ruby-doc-2.6.9-120.el7 +18
    • Red Hat Software Collections for RHEL(v. 7) rh-ruby26-ruby-2.6.9-120.el7, rh-ruby26-ruby-devel-2.6.9-120.el7, rh-ruby26-ruby-doc-2.6.9-120.el7 +18
  • RHSA-2022:0582 Released 2022-02-21 · Red Hat rating Important
    ruby:2.6 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 8.2) ruby-2.6.9-107.module+el8.2.0+14086+86d863af.aarch64::ruby:2.6, ruby-2.6.9-107.module+el8.2.0+14086+86d863af.i686::ruby:2.6, ruby-2.6.9-107.module+el8.2.0+14086+86d863af.ppc64le::ruby:2.6 +47
  • RHSA-2022:0581 Released 2022-02-21 · Red Hat rating Important
    ruby:2.6 security update
    • Red Hat Enterprise Linux AppStream E4S (v. 8.1) ruby-2.6.9-107.module+el8.1.0+14088+04cf326e.i686::ruby:2.6, ruby-2.6.9-107.module+el8.1.0+14088+04cf326e.ppc64le::ruby:2.6, ruby-2.6.9-107.module+el8.1.0+14088+04cf326e.src::ruby:2.6 +47
Show 9 more Red Hat advisories
  • RHSA-2022:0546 Released 2022-02-16 · Red Hat rating Important
    ruby:2.5 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.4) rubygem-bundler-1.16.1-4.module+el8.4.0+14083+f9ece6dd.noarch::ruby:2.5, rubygem-bundler-1.16.1-4.module+el8.4.0+14083+f9ece6dd.src::ruby:2.5, rubygem-bundler-doc-1.16.1-4.module+el8.4.0+14083+f9ece6dd.noarch::ruby:2.5
  • RHSA-2022:0545 Released 2022-02-16 · Red Hat rating Important
    ruby:2.5 security update
    • Red Hat Enterprise Linux AppStream (v. 8) rubygem-bundler-1.16.1-4.module+el8.5.0+13840+ec418553.noarch::ruby:2.5, rubygem-bundler-1.16.1-4.module+el8.5.0+13840+ec418553.src::ruby:2.5, rubygem-bundler-doc-1.16.1-4.module+el8.5.0+13840+ec418553.noarch::ruby:2.5
  • RHSA-2022:0544 Released 2022-02-16 · Red Hat rating Important
    ruby:2.6 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.4) ruby-2.6.9-108.module+el8.4.0+14070+b3717926.aarch64::ruby:2.6, ruby-2.6.9-108.module+el8.4.0+14070+b3717926.i686::ruby:2.6, ruby-2.6.9-108.module+el8.4.0+14070+b3717926.ppc64le::ruby:2.6 +47
  • RHSA-2022:0543 Released 2022-02-16 · Red Hat rating Important
    ruby:2.6 security update
    • Red Hat Enterprise Linux AppStream (v. 8) ruby-2.6.9-108.module+el8.5.0+13719+08a8ba32.aarch64::ruby:2.6, ruby-2.6.9-108.module+el8.5.0+13719+08a8ba32.i686::ruby:2.6, ruby-2.6.9-108.module+el8.5.0+13719+08a8ba32.ppc64le::ruby:2.6 +47
  • RHSA-2022:0547 Released 2022-02-16 · Red Hat rating Important
    ruby:2.5 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 8.2) rubygem-bundler-1.16.1-4.module+el8.2.0+14084+4fedcad5.noarch::ruby:2.5, rubygem-bundler-1.16.1-4.module+el8.2.0+14084+4fedcad5.src::ruby:2.5, rubygem-bundler-doc-1.16.1-4.module+el8.2.0+14084+4fedcad5.noarch::ruby:2.5
  • RHSA-2022:0548 Released 2022-02-16 · Red Hat rating Important
    ruby:2.5 security update
    • Red Hat Enterprise Linux AppStream E4S (v. 8.1) rubygem-bundler-1.16.1-4.module+el8.1.0+14085+cd0ba992.noarch::ruby:2.5, rubygem-bundler-1.16.1-4.module+el8.1.0+14085+cd0ba992.src::ruby:2.5, rubygem-bundler-doc-1.16.1-4.module+el8.1.0+14085+cd0ba992.noarch::ruby:2.5
  • RHSA-2021:3982 Released 2021-10-25 · Red Hat rating Important
    rh-ruby30-ruby security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-ruby30-ruby-3.0.2-148.el7, rh-ruby30-ruby-default-gems-3.0.2-148.el7, rh-ruby30-ruby-devel-3.0.2-148.el7 +18
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-ruby30-ruby-3.0.2-148.el7, rh-ruby30-ruby-default-gems-3.0.2-148.el7, rh-ruby30-ruby-devel-3.0.2-148.el7 +18
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-ruby30-ruby-3.0.2-148.el7, rh-ruby30-ruby-default-gems-3.0.2-148.el7, rh-ruby30-ruby-devel-3.0.2-148.el7 +18
  • RHSA-2021:3559 Released 2021-09-20 · Red Hat rating Important
    rh-ruby27-ruby security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-ruby27-ruby-2.7.4-130.el7, rh-ruby27-ruby-devel-2.7.4-130.el7, rh-ruby27-ruby-doc-2.7.4-130.el7 +19
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-ruby27-ruby-2.7.4-130.el7, rh-ruby27-ruby-devel-2.7.4-130.el7, rh-ruby27-ruby-doc-2.7.4-130.el7 +19
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-ruby27-ruby-2.7.4-130.el7, rh-ruby27-ruby-devel-2.7.4-130.el7, rh-ruby27-ruby-doc-2.7.4-130.el7 +19
  • RHSA-2021:3020 Released 2021-08-05 · Red Hat rating Important
    ruby:2.7 security update
    • Red Hat Enterprise Linux AppStream (v. 8) ruby-2.7.4-137.module+el8.4.0+12025+f744ca41.aarch64::ruby:2.7, ruby-2.7.4-137.module+el8.4.0+12025+f744ca41.i686::ruby:2.7, ruby-2.7.4-137.module+el8.4.0+12025+f744ca41.ppc64le::ruby:2.7 +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
CloudForms Management Engine 5AffectedNo fix planned: Will not fix
Logging Subsystem for Red Hat OpenShiftAffectedNo fix yet
Red Hat 3scale API Management Platform 2AffectedNo fix yet: Fix deferred
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2021:3020, RHSA-2022:0543, RHSA-2022:0545
Red Hat Enterprise Linux AppStream E4S (v. 8.1)Fixed RHSA-2022:0548, RHSA-2022:0581
Red Hat Enterprise Linux AppStream EUS (v. 8.2)Fixed RHSA-2022:0547, RHSA-2022:0582
Red Hat Enterprise Linux AppStream EUS (v.8.4)Fixed RHSA-2022:0544, RHSA-2022:0546
Red Hat Software Collections for RHEL Workstation(v. 7)Fixed RHSA-2022:0708
Red Hat Software Collections for RHEL(v. 7)Fixed RHSA-2022:0708
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2021:3559, RHSA-2021:3982
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2021:3559, RHSA-2021:3982
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2021:3559, RHSA-2021:3982
Not affected: 6 products
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AppStream (v. 8)
  • Red Hat Enterprise Linux AppStream E4S (v. 8.1)
  • Red Hat Enterprise Linux AppStream EUS (v. 8.2)
  • Red Hat Enterprise Linux AppStream EUS (v.8.4)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-36327
  2. 2026-10-03 Alias added: GHSA-fp4w-jxhp-m23p
  3. 2026-10-08 CISA SSVC decision points changed

References

Exploit 2

Patch 1

Advisory 4

Other 8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences