CVE-2019-3881
Summary
| CVE | CVE-2019-3881 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-09-04 12:15:00 UTC |
| Updated | 2022-11-08 19:50:00 UTC |
| Description | Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed. |
Risk And Classification
Problem Types: CWE-427
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| 1651826 – (CVE-2019-3881) CVE-2019-3881 rubygem-bundler: Insecure permissions on directory in /tmp/ allows for execution of malicious code | MISC | bugzilla.redhat.com | Issue Tracking, Patch, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 159298 Oracle Enterprise Linux Security Update for ruby:2.6 (ELSA-2021-2588)
- 239368 Red Hat Update for rh-ruby26-ruby (RHSA-2021:2230)
- 239461 Red Hat Update for ruby:2.6 (RHSA-2021:2588)
- 375379 GitLab Multiple Security Vulnerabilities(gitlab-13-7-2)
- 690370 Free Berkeley Software Distribution (FreeBSD) Security Update for gitlab (a2a2b34d-52b4-11eb-87cb-001b217b3468)
- 940189 AlmaLinux Security Update for ruby:2.6 (ALSA-2021:2588)
- 960022 Rocky Linux Security Update for ruby:2.6 (RLSA-2021:2588)