Description: Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed. Need to stabilize 2.1.4, and move over anything depending on bundler:0.
arm stable
ppc stable
ppc64 stable
arm64 done
sparc stable
amd64 stabled by zlogene
(In reply to Sam James from comment #6) > amd64 stabled by zlogene This mornings 'emerge -auDN system world' : * Error: The above package list contains packages which cannot be * installed at the same time on the same system. (dev-ruby/bundler-2.1.4:2/2::gentoo, ebuild scheduled for merge) pulled in by >=dev-ruby/bundler-1.17.2[ruby_targets_ruby26] required by (dev-lang/ruby-2.6.6-r2:2.6/2.6::gentoo, installed) ... # equery list -p dev-ruby/bundler [IP-] [ ] dev-ruby/bundler-1.17.3:0 [-P-] [ ] dev-ruby/bundler-1.17.3-r1:0 [-P-] [ ] dev-ruby/bundler-2.1.4:2 <--- # equery depends dev-ruby/bundler dev-lang/ruby-2.6.6-r2 (>=dev-ruby/bundler-1.17.2[ruby_targets_ruby26]) dev-ruby/rdoc-6.1.2 (test ? dev-ruby/bundler[ruby_targets_ruby25(-)]) (test ? dev-ruby/bundler[ruby_targets_ruby26(-)]) # eselect ruby list [1] ruby25 (with Rubygems) [2] ruby26 (with Rubygems) *
(In reply to Manfred Knick from comment #7) Having hard-masked :2 / updated world / removing hard-mask, again updating MPT right now, slotted install has succeeded.
(In reply to Manfred Knick from comment #8) > (In reply to Manfred Knick from comment #7) > > Having hard-masked :2 / updated world / removing hard-mask, > again updating MPT right now, slotted install has succeeded. For anyone hitting this issue: > [blocks B] <dev-ruby/bundler-1.17.3-r1:0 ("<dev-ruby/bundler-1.17.3-r1:0" is hard blocking dev-ruby/bundler-2.1.4) is the key line. If we go on packages.gentoo.org [0], we can see that a version satisfying that constraint exists -- we want >=dev-ruby/bundler-1.17.3-r1:0. The solution is to upgrade slot :0: # emerge -v1u dev-ruby/bundler:0 I asked Zac about this and it turns out there's a bug for Portage being able to solve this by itself: bug 250286. [0] https://packages.gentoo.org/packages/dev-ruby/bundler
x86 stable
(In reply to Sam James from comment #9) > (In reply to Manfred Knick from comment #8) > > (In reply to Manfred Knick from comment #7) > > > > Having hard-masked :2 / updated world / removing hard-mask, > > again updating MPT right now, slotted install has succeeded. > > For anyone hitting this issue: > > > [blocks B] <dev-ruby/bundler-1.17.3-r1:0 ("<dev-ruby/bundler-1.17.3-r1:0" is hard blocking dev-ruby/bundler-2.1.4) > > is the key line. If we go on packages.gentoo.org [0], we can see that a > version satisfying that constraint exists -- we want > >=dev-ruby/bundler-1.17.3-r1:0. > > The solution is to upgrade slot :0: > # emerge -v1u dev-ruby/bundler:0 > > I asked Zac about this and it turns out there's a bug for Portage being able > to solve this by itself: bug 250286. > > [0] https://packages.gentoo.org/packages/dev-ruby/bundler Upgrading package slot seems to have done the job. Thanks.
hppa stable
# Hans de Graaff <graaff@gentoo.org> (2020-12-12) # Security issue with insecure use of /tmp, bug 743214 # This slot masked for removal in 30 days, use slot 2 instead. dev-ruby/bundler:0
Unable to check for sanity: > package masked: dev-ruby/bundler-1.17.3-r1
s390 done all arches done
Please cleanup, thanks!
Looks like cleanup was done some time ago: commit cf01c15294dc34304d7366f49772dbfb3ec5c7b3 Author: Hans de Graaff <graaff@gentoo.org> Date: Thu Jan 28 06:45:23 2021 +0100 dev-ruby/bundler: cleanup Package-Manager: Portage-3.0.13, Repoman-3.0.2 Signed-off-by: Hans de Graaff <graaff@gentoo.org> delete mode 100644 dev-ruby/bundler/bundler-2.2.0.ebuild delete mode 100644 dev-ruby/bundler/bundler-2.2.3.ebuild delete mode 100644 dev-ruby/bundler/bundler-2.2.4.ebuild
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/data/glsa.git/commit/?id=cf9015f3dee372a335e1d143abb09a32c988e7fa commit cf9015f3dee372a335e1d143abb09a32c988e7fa Author: GLSAMaker <glsamaker@gentoo.org> AuthorDate: 2024-08-10 08:23:41 +0000 Commit: Hans de Graaff <graaff@gentoo.org> CommitDate: 2024-08-10 08:23:53 +0000 [ GLSA 202408-22 ] Bundler: Multiple Vulnerabilities Bug: https://bugs.gentoo.org/743214 Bug: https://bugs.gentoo.org/798135 Bug: https://bugs.gentoo.org/828884 Signed-off-by: GLSAMaker <glsamaker@gentoo.org> Signed-off-by: Hans de Graaff <graaff@gentoo.org> glsa-202408-22.xml | 46 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+)
