Skip to content
Fencer Intel
high 8.8

CVE-2020-36327 json

Dependency Confusion in Bundler

published 5y ago modified last mo. also GHSA-fp4w-jxhp-m23p , EUVD-2021-1063

cvss
8.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
6.3%
EPSS 6.3% chance of exploitation in 30 days, percentile 93%
public exploits
0
none known

Summary

Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every "Dependency Confusion" issue in every product.

Patch / fix

  • rubygems bundler 2.2.10, 2.2.18
  • bundler bundler 2.2.10
  • rubygems Debian 14, Debian 13, Debian 12 3.3.5-1

debian advisories DEBIAN-CVE-2020-36327

  • rubygem-pg RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 1.1.4-1.module+el8.1.0+3653+beb38eb0
  • rubygem-abrt RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 0.3.0-4.module+el8.1.0+3653+beb38eb0
  • rubygem-bson RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 4.5.0-1.module+el8.1.0+3653+beb38eb0
  • rubygem-mongo RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 2.8.0-1.module+el8.1.0+3653+beb38eb0
  • rh-ruby26-ruby RHEL 3 SOFTWARE_COLLECTIONS 2.6.9-120.el7
  • rh-ruby26-rubygems RHEL 3 SOFTWARE_COLLECTIONS 3.0.3.1-120.el7
  • rh-ruby26-ruby-libs RHEL 3 SOFTWARE_COLLECTIONS 2.6.9-120.el7
  • rh-ruby26-rubygem-irb RHEL 3 SOFTWARE_COLLECTIONS 1.0.0-120.el7

red hat advisories RHSA-2022:0582RHSA-2022:0581RHSA-2022:0708RHSA-2022:0544RHSA-2022:0543RHSA-2021:3982

  • rubygem-bundler SLE Module for Basesystem 15 SP7 2.2.34-150700.21.3.1
  • rubygem-bundler SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +13 more 2.2.34-150000.3.11.1

suse advisories SUSE-SU-2026:1355-1SUSE-SU-2025:1294-1

  • ruby AlmaLinux 8 2.5.9-107.module_el8.5.0+2625+ec418553
  • ruby-irb AlmaLinux 8 2.5.9-107.module_el8.5.0+2625+ec418553
  • rubygems AlmaLinux 8 2.7.6.3-107.module_el8.5.0+2625+ec418553
  • ruby-libs AlmaLinux 8 2.5.9-107.module_el8.5.0+2625+ec418553
  • rubygem-pg AlmaLinux 8 1.0.0-2.module_el8.5.0+2625+ec418553
  • rubygem-pg AlmaLinux 8 1.0.0-2.module_el8.5.0+259+8cec6917
  • rubygem-abrt AlmaLinux 8 0.3.0-4.module_el8.5.0+2625+ec418553
  • rubygem-abrt AlmaLinux 8 0.3.0-4.module_el8.5.0+259+8cec6917

almalinux advisories ALSA-2022:0545ALSA-2022:0543ALSA-2021:3020

  • ruby Rocky Linux 8 2.5.9-107.module+el8.4.0+592+03ff458a
  • rubygem-pg Rocky Linux 8 1.0.0-2.module+el8.4.0+592+03ff458a
  • rubygem-pg Rocky Linux 8 1.0.0-2.module+el8.3.0+167+5c390590
  • rubygem-abrt Rocky Linux 8 0.3.0-4.module+el8.5.0+738+032c9c02
  • rubygem-abrt Rocky Linux 8 0.3.0-4.module+el8.3.0+167+5c390590
  • rubygem-abrt Rocky Linux 8 0.3.0-4.module+el8.4.0+592+03ff458a
  • rubygem-bson Rocky Linux 8 4.3.0-2.module+el8.4.0+592+03ff458a
  • rubygem-bson Rocky Linux 8 4.3.0-2.module+el8.3.0+167+5c390590

rocky linux advisories RLSA-2022:0545RLSA-2022:0543RLSA-2021:3020

  • ruby-bundler Arch Linux 2.2.18-1

arch linux advisories AVG-1891

Is CVE-2020-36327 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-36327 updated cvss 8.8

rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source

  • Red Hat CloudForms Management Engine 5 rubygem-bundler
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Logging Subsystem for Red Hat OpenShift ruby
    affected: workaround, no fix available
  • Red Hat 3scale API Management Platform 2 rubygem-bundler
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Software Collections rh-ruby25-rubygem-bundler
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Enterprise Linux AppStream (v. 8) ruby 2.7.4-137.module+el8.4.0+12025+f744ca41, rubygem-pg 1.2.3-1.module+el8.3.0+7192+4e3a532a, rubygems 3.1.6-137.module+el8.4.0+12025+f744ca41, ruby-libs 2.7.4-137.module+el8.4.0+12025+f744ca41, rubygem-abrt 0.4.0-1.module+el8.3.0+7192+4e3a532a, rubygem-bson 4.8.1-1.module+el8.3.0+7192+4e3a532a, +19 more
    fixed: vendor fix RHSA-2021:3020
  • Red Hat Enterprise Linux AppStream E4S (v. 8.1) rubygem-bundler 1.16.1-4.module+el8.1.0+14085+cd0ba992, rubygem-bundler 1.17.2-107.module+el8.1.0+14088+04cf326e
    fixed: vendor fix RHSA-2022:0548
  • Red Hat Enterprise Linux AppStream EUS (v. 8.2) rubygem-bundler 1.16.1-4.module+el8.2.0+14084+4fedcad5, rubygem-bundler 1.17.2-107.module+el8.2.0+14086+86d863af
    fixed: vendor fix RHSA-2022:0547
  • Red Hat Enterprise Linux AppStream EUS (v.8.4) rubygem-bundler 1.16.1-4.module+el8.4.0+14083+f9ece6dd, rubygem-bundler 1.17.2-108.module+el8.4.0+14070+b3717926
    fixed: vendor fix RHSA-2022:0546
show 3 more
  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-ruby27-ruby 2.7.4-130.el7, rh-ruby30-ruby 3.0.2-148.el7, rh-ruby27-rubygems 3.1.6-130.el7, rh-ruby27-ruby-libs 2.7.4-130.el7, rh-ruby30-ruby-libs 3.0.2-148.el7, rh-ruby30-rubygems 3.2.22-148.el7, +31 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-ruby27-ruby 2.7.4-130.el7, rh-ruby30-ruby 3.0.2-148.el7, rh-ruby27-rubygems 3.1.6-130.el7, rh-ruby27-ruby-libs 2.7.4-130.el7, rh-ruby30-ruby-libs 3.0.2-148.el7, rh-ruby30-rubygems 3.2.22-148.el7, +31 more Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-ruby27-ruby 2.7.4-130.el7, rh-ruby30-ruby 3.0.2-148.el7, rh-ruby27-rubygems 3.1.6-130.el7, rh-ruby27-ruby-libs 2.7.4-130.el7, rh-ruby30-ruby-libs 3.0.2-148.el7, rh-ruby30-rubygems 3.2.22-148.el7, +31 more
    fixed: vendor fix RHSA-2021:3559
  • Red Hat Software Collections for RHEL Workstation(v. 7) rh-ruby26-ruby 2.6.9-120.el7, rh-ruby26-ruby-libs 2.6.9-120.el7, rh-ruby26-rubygems 3.0.3.1-120.el7, rh-ruby26-rubygem-irb 1.0.0-120.el7, rh-ruby26-rubygem-json 2.1.0-120.el7, rh-ruby26-rubygem-psych 3.1.0-120.el7, +12 more Red Hat Software Collections for RHEL(v. 7) rh-ruby26-ruby 2.6.9-120.el7, rh-ruby26-ruby-libs 2.6.9-120.el7, rh-ruby26-rubygems 3.0.3.1-120.el7, rh-ruby26-rubygem-irb 1.0.0-120.el7, rh-ruby26-rubygem-json 2.1.0-120.el7, rh-ruby26-rubygem-psych 3.1.0-120.el7, +12 more
    fixed: vendor fix RHSA-2022:0708
  • Red Hat Enterprise Linux 7 rubygem-bundler Red Hat Enterprise Linux 9 ruby, rubygems, ruby-libs, rubygem-irb, rubygem-rbs, rubygem-rss, +13 more Red Hat Enterprise Linux AppStream (v. 8) ruby 2.5.9-107.module+el8.5.0+13840+ec418553, ruby 2.6.9-108.module+el8.5.0+13719+08a8ba32, rubygem-pg 1.0.0-2.module+el8.1.0+3656+f80bfa1d, rubygem-pg 1.1.4-1.module+el8.1.0+3653+beb38eb0, ruby-irb 2.5.9-107.module+el8.5.0+13840+ec418553, ruby-libs 2.5.9-107.module+el8.5.0+13840+ec418553, +38 more Red Hat Enterprise Linux AppStream E4S (v. 8.1) ruby 2.5.5-105.module+el8.1.0+3656+f80bfa1d, ruby 2.6.9-107.module+el8.1.0+14088+04cf326e, ruby-irb 2.5.5-105.module+el8.1.0+3656+f80bfa1d, rubygem-pg 1.0.0-2.module+el8.1.0+3656+f80bfa1d, rubygem-pg 1.1.4-1.module+el8.1.0+3653+beb38eb0, ruby-libs 2.5.5-105.module+el8.1.0+3656+f80bfa1d, +38 more Red Hat Enterprise Linux AppStream EUS (v. 8.2) ruby 2.5.5-105.module+el8.1.0+3656+f80bfa1d, ruby 2.6.9-107.module+el8.2.0+14086+86d863af, ruby-irb 2.5.5-105.module+el8.1.0+3656+f80bfa1d, rubygem-pg 1.0.0-2.module+el8.1.0+3656+f80bfa1d, rubygem-pg 1.1.4-1.module+el8.1.0+3653+beb38eb0, ruby-libs 2.5.5-105.module+el8.1.0+3656+f80bfa1d, +38 more Red Hat Enterprise Linux AppStream EUS (v.8.4) ruby 2.5.9-107.module+el8.4.0+10822+fe4fffb1, ruby 2.6.9-108.module+el8.4.0+14070+b3717926, rubygem-pg 1.0.0-2.module+el8.1.0+3656+f80bfa1d, rubygem-pg 1.1.4-1.module+el8.1.0+3653+beb38eb0, ruby-irb 2.5.9-107.module+el8.4.0+10822+fe4fffb1, ruby-libs 2.5.9-107.module+el8.4.0+10822+fe4fffb1, +38 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
last mo.

Exploit prediction

6.31% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/rubygems/rubygems/issues/3982 referenced PoC, tagged "exploit" by a source, unverified
  • zofrex.com https://www.zofrex.com/blog/2021/04/29/bundler-still-vulnerable-dependency-confusion-cve-2020-36327/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C
GitHub 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
rubygems bundler
>=1.16.0, <2.2.10
>=2.2.11, <2.2.18
2.2.10
2.2.18

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.