CVE-2019-3881: Files or Directories Accessible to External Parties

September 4, 2020 (updated September 16, 2020)

Bundler uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user’s home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.

References

bugzilla.redhat.com/show_bug.cgi?id=1651826
nvd.nist.gov/vuln/detail/CVE-2019-3881

Code Behaviors & Features

Detect and mitigate CVE-2019-3881 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →