SB2024081003 - Gentoo update for Bundler

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Files or Directories Accessible to External Parties (CVE-ID: CVE-2019-3881)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to Bundler uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.

2) Insufficient verification of data authenticity (CVE-ID: CVE-2020-36327)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient verification of data authenticity in Bundler, when  choosing a dependency source. The application selects a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application.

3) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: CVE-2021-43809)

The vulnerability allows a local user to execute arbitrary code on the target system.

The vulnerability occurs when working with untrusted and apparently harmless `Gemfile`'s. A local user can trick the victim into opening a specially crafted directory containing a `Gemfile` file that declares a dependency that is located in a Git repository and execute arbitrary code on the target system.

Remediation

Install update from vendor's website.

References

• https://security.gentoo.org/glsa/202408-22