Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2013-0334.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - rubygem-bundler: Code execution via gem name collision in bundler (CVE-2016-7954)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - rubygem-bundler: Code execution via gem name collision in bundler (CVE-2016-7954)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

ID	Name	Product	Family	Severity
198664	RHEL 7 : rubygem-bundler (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198607	RHEL 6 : rubygem-bundler (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
195841	RHEL 6 : rubygem-bundler (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
195810	RHEL 7 : rubygem-bundler (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2016-7954

critical

Tenable Plugins

critical

critical

critical

critical