CVE-2020-36327

HighCVSS 8.8/10Last modified Oct 8, 2026

Description

Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every "Dependency Confusion" issue in every product.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bundler.io/blog/2021/02/15/a-more-secure-bundler-we-fixed-our-source-priorities.htmlVendor Advisory
https://github.com/rubygems/rubygems/issues/3982Exploit, Issue Tracking, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MWXHK5UUHVSHF7HTHMX6JY3WXDVNIHSL/
https://mensfeld.pl/2021/02/rubygems-dependency-confusion-attack-side-of-things/Third Party Advisory
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-24105Patch, Vendor Advisory
https://www.zofrex.com/blog/2021/04/29/bundler-still-vulnerable-dependency-confusion-cve-2020-36327/Exploit, Third Party Advisory
https://bundler.io/blog/2021/02/15/a-more-secure-bundler-we-fixed-our-source-priorities.htmlVendor Advisory
https://github.com/rubygems/rubygems/issues/3982Exploit, Issue Tracking, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MWXHK5UUHVSHF7HTHMX6JY3WXDVNIHSL/
https://mensfeld.pl/2021/02/rubygems-dependency-confusion-attack-side-of-things/Third Party Advisory
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-24105Patch, Vendor Advisory
https://www.zofrex.com/blog/2021/04/29/bundler-still-vulnerable-dependency-confusion-cve-2020-36327/Exploit, Third Party Advisory

Timeline

Published: Apr 29, 2021
Last modified: Oct 8, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-363289.8A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function WebPDecodeRGBInto is possible due to an inval CVE-2020-363299.8A flaw was found in libwebp in versions before 1.0.1. A use-after-free was found due to a thread being killed too early. The highest threat CVE-2020-36339.8Array out of bound may occur while playing mp3 file as no check is there on offset if it is greater than the buffer allocated or not in Snap CVE-2020-363309.1A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkVerifyAndAssign. The highest threat f CVE-2020-363319.1A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkAssignData. The highest threat from t CVE-2020-363327.5A flaw was found in libwebp in versions before 1.0.1. When reading a file libwebp allocates an excessive amount of memory. The highest threa CVE-2020-363339.1themegrill-demo-importer before 1.6.2 does not require authentication for wiping the database, because of a reset_wizard_actions hook.CVE-2020-363348.8themegrill-demo-importer before 1.6.3 allows CSRF, as demonstrated by wiping the database.CVE-2020-36349.1u'Multiple Read overflows issue due to improper length check while decoding Generic NAS transport/EMM info' in Snapdragon Auto, Snapdragon C CVE-2020-36357.8Stack based overflow If the maximum number of arguments allowed per request in perflock exceeds in Snapdragon Auto, Snapdragon Compute, Snap CVE-2020-36367.8u'Out of bound writes happen when accessing usage_table header entry beyond the memory allocated for the header' in Snapdragon Auto, Snapdra CVE-2020-363639.8Amazon AWS CloudFront TLSv1.2_2019 allows TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 and TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, which some entiti