StackRadar

CVE-2016-7954

Critical

Advisory

Published 14 May 2022In the index since 6 Sept 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.085
95th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
22
of 17,781 indexed, latest versions
Container images
24
deployed by those charts
Fix available
1 of 1
affected package

Bundler allows attacker to inject arbitrary code via secondary Gem source

Carried by container images the latest versions of 22 of 17,781 indexed charts deploy, on 24 images.

Affected packageAffected versionsFixed inImages
bundlergem1.15.4, 1.16.1, 1.16.2, 1.16.6+2 more2.0.024
OSV records
GHSA-jvgm-pfqv-887x

Charts affected

22 by stars
ChartLatestAffected imagesRadar Score
efkcryptexlabsVerified publisher7.17.31 of 3See more

efk cryptexlabs 7.17.3

1 of the 3 container images this version deploys carry CVE-2016-7954.

Container imageDigestPackageFixed in
fluent/fluentd-kubernetes-daemonset:v1.12.4-debian-elasticsearch7-1.0656423b5fabb
bundler@1.17.2
2.0.0

Open the chart page →

1,299
huginnutkuozdemirVerified publisher2.2.11 of 4See more

huginn utkuozdemir 2.2.1

1 of the 4 container images this version deploys carry CVE-2016-7954.

Container imageDigestPackageFixed in
huginn/huginn-single-process:4d17829cf6b15b004ad3f4be196303dca4944810c794eddc7b47
bundler@1.17.3
2.0.0

Open the chart page →

18,137
pact-brokeralmorgvVerified publisher0.1.01 of 1See more

pact-broker almorgv 0.1.0

1 of the 1 container images this version deploys carry CVE-2016-7954.

Container imageDigestPackageFixed in
pactfoundation/pact-broker:2.79.1.112861b0bd4d9
bundler@1.17.2
2.0.0

Open the chart page →

4,995
zammaddevplayer0Verified publisher4.0.51 of 4See more

zammad devplayer0 4.0.5

1 of the 4 container images this version deploys carry CVE-2016-7954.

Container imageDigestPackageFixed in
zammad/zammad-docker-compose:zammad-4.1.0-312808e2dfa810
bundler@1.17.2
2.0.0

Open the chart page →

6,110
istio-bookinfobookinfo1.2.21 of 6See more

istio-bookinfo bookinfo 1.2.2

1 of the 6 container images this version deploys carry CVE-2016-7954.

Container imageDigestPackageFixed in
istio/examples-bookinfo-details-v1:1.15.0fce0bcbff0be
bundler@1.17.2
2.0.0

Open the chart page →

18,980
honeywell-exporterbryanalves0.1.11 of 1See more

honeywell-exporter bryanalves 0.1.1

1 of the 1 container images this version deploys carry CVE-2016-7954.

Container imageDigestPackageFixed in
bryanalves/honeywell_exporter:0.0.1195f73dce8b21
bundler@1.16.1
2.0.0

Open the chart page →

5,437
smart-exporterbryanalves0.2.21 of 1See more

smart-exporter bryanalves 0.2.2

1 of the 1 container images this version deploys carry CVE-2016-7954.

Container imageDigestPackageFixed in
bryanalves/smart_exporter:0.2af47dfbb9413
bundler@1.16.6
2.0.0

Open the chart page →

4,131
fluentd-cloudwatchcloudnativeapp0.9.01 of 2See more

fluentd-cloudwatch cloudnativeapp 0.9.0

1 of the 2 container images this version deploys carry CVE-2016-7954.

Container imageDigestPackageFixed in
fluent/fluentd-kubernetes-daemonset:v1.3.3-debian-cloudwatch-1.017398121d3cc
bundler@1.16.2
2.0.0

Open the chart page →

1,342
puppet-forgecloudnativeapp0.1.81 of 2See more

puppet-forge cloudnativeapp 0.1.8

1 of the 2 container images this version deploys carry CVE-2016-7954.

Container imageDigestPackageFixed in
hickey/puppet_forge:1.10.0c1148a09ef20
bundler@1.15.4
2.0.0

Open the chart page →

4,086
fluentd-kubernetes-awscloudposse0.2.11 of 2See more

fluentd-kubernetes-aws cloudposse 0.2.1

1 of the 2 container images this version deploys carry CVE-2016-7954.

Container imageDigestPackageFixed in
fluent/fluentd-kubernetes-daemonset:v1.4.2-debian-elasticsearch-1.1ce4885865850
bundler@1.17.2
2.0.0

Open the chart page →

1,305
gwangju_2-3gwangju2-30.1.01 of 5See more

gwangju_2-3 gwangju2-3 0.1.0

1 of the 5 container images this version deploys carry CVE-2016-7954.

Container imageDigestPackageFixed in
fluent/fluentd-kubernetes-daemonset:v1.10.3-debian-cloudwatch-1.019a8f0662241
bundler@1.17.2
2.0.0

Open the chart page →

6,491
fluentdhelm0.2.161 of 1See more

fluentd helm 0.2.16

1 of the 1 container images this version deploys carry CVE-2016-7954.

Container imageDigestPackageFixed in
fluent/fluentd-kubernetes-daemonset:v1.14.0-debian-elasticsearch7-1.03933cae61054
bundler@1.17.2
2.0.0

Open the chart page →

1,217
istio-bookinfoistio-bookinfo1.2.21 of 6See more

istio-bookinfo istio-bookinfo 1.2.2

1 of the 6 container images this version deploys carry CVE-2016-7954.

Container imageDigestPackageFixed in
istio/examples-bookinfo-details-v1:1.15.0fce0bcbff0be
bundler@1.17.2
2.0.0

Open the chart page →

18,980
gitlabkubesphereVerified publisher4.2.36 of 17See more

gitlab kubesphere 4.2.3

6 of the 17 container images this version deploys carry CVE-2016-7954.

Container imageDigestPackageFixed in
mirrorgitlabcontainers/gitaly:v13.2.283599461ef8b
bundler@1.16.6
2.0.0
mirrorgitlabcontainers/gitlab-shell:v13.3.09f3654f1eafc
bundler@1.17.3
2.0.0
mirrorgitlabcontainers/gitlab-sidekiq-ce:v13.2.294d1431683fa
bundler@1.16.6
2.0.0
mirrorgitlabcontainers/gitlab-task-runner-ce:v13.2.29efd73993c34
bundler@1.16.6
2.0.0
mirrorgitlabcontainers/gitlab-webservice-ce:v13.2.230393f990f5c
bundler@1.16.6
2.0.0
mirrorgitlabcontainers/gitlab-workhorse-ce:v13.2.2a6d7bf42805a
bundler@1.16.6
2.0.0

Open the chart page →

38,133
sample-bookinfokubesphere-testVerified publisher1.0.01 of 4See more

sample-bookinfo kubesphere-test 1.0.0

1 of the 4 container images this version deploys carry CVE-2016-7954.

Container imageDigestPackageFixed in
kubesphere/examples-bookinfo-details-v1:1.13.0108d022f64f0
bundler@1.17.2
2.0.0

Open the chart page →

9,378
fluentd-papertrailmozilla0.2.21 of 1See more

fluentd-papertrail mozilla 0.2.2

1 of the 1 container images this version deploys carry CVE-2016-7954.

Container imageDigestPackageFixed in
fluent/fluentd-kubernetes-daemonset:papertrail9c209835eea1
bundler@1.16.2
2.0.0

Open the chart page →

1,001
betydbncsaVerified publisher0.6.11 of 4See more

betydb ncsa 0.6.1

1 of the 4 container images this version deploys carry CVE-2016-7954.

Container imageDigestPackageFixed in
pecan/bety:5.4.1f825d480cd62
bundler@1.17.2
2.0.0

Open the chart page →

9,542
pecanncsaVerified publisher0.6.21 of 15See more

pecan ncsa 0.6.2

1 of the 15 container images this version deploys carry CVE-2016-7954.

Container imageDigestPackageFixed in
pecan/bety:5.4.1f825d480cd62
bundler@1.17.2
2.0.0

Open the chart page →

14,154
pact-brokerqamatic0.1.01 of 2See more

pact-broker qamatic 0.1.0

1 of the 2 container images this version deploys carry CVE-2016-7954.

Container imageDigestPackageFixed in
pactfoundation/pact-broker:2.32.0-2062d6c710099
bundler@1.17.2
2.0.0

Open the chart page →

3,533
bookinforgnu1.0.01 of 7See more

bookinfo rgnu 1.0.0

1 of the 7 container images this version deploys carry CVE-2016-7954.

Container imageDigestPackageFixed in
istio/examples-bookinfo-details-v1:1.14.04c3379923c8a
bundler@1.17.2
2.0.0

Open the chart page →

20,462
istio-bookinforgnu1.0.21 of 7See more

istio-bookinfo rgnu 1.0.2

1 of the 7 container images this version deploys carry CVE-2016-7954.

Container imageDigestPackageFixed in
istio/examples-bookinfo-details-v1:1.14.04c3379923c8a
bundler@1.17.2
2.0.0

Open the chart page →

20,462
fluentdslamdev0.0.61 of 1See more

fluentd slamdev 0.0.6

1 of the 1 container images this version deploys carry CVE-2016-7954.

Container imageDigestPackageFixed in
fluent/fluentd-kubernetes-daemonset:v1.11.5-debian-forward-1.00717111a3362
bundler@1.17.2
2.0.0

Open the chart page →

1,384

Container images carrying it

24 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
istio/examples-bookinfo-details-v1:1.14.04c3379923c8a
bundler@1.17.2
2.0.0
2
istio/examples-bookinfo-details-v1:1.15.0fce0bcbff0be
bundler@1.17.2
2.0.0
2
pecan/bety:5.4.1f825d480cd62
bundler@1.17.2
2.0.0
2
bryanalves/honeywell_exporter:0.0.1195f73dce8b21
bundler@1.16.1
2.0.0
1
bryanalves/smart_exporter:0.2af47dfbb9413
bundler@1.16.6
2.0.0
1
fluent/fluentd-kubernetes-daemonset:v1.11.5-debian-forward-1.00717111a3362
bundler@1.17.2
2.0.0
1
fluent/fluentd-kubernetes-daemonset:v1.3.3-debian-cloudwatch-1.017398121d3cc
bundler@1.16.2
2.0.0
1
fluent/fluentd-kubernetes-daemonset:v1.10.3-debian-cloudwatch-1.019a8f0662241
bundler@1.17.2
2.0.0
1
fluent/fluentd-kubernetes-daemonset:v1.14.0-debian-elasticsearch7-1.03933cae61054
bundler@1.17.2
2.0.0
1
fluent/fluentd-kubernetes-daemonset:v1.12.4-debian-elasticsearch7-1.0656423b5fabb
bundler@1.17.2
2.0.0
1
fluent/fluentd-kubernetes-daemonset:papertrail9c209835eea1
bundler@1.16.2
2.0.0
1
fluent/fluentd-kubernetes-daemonset:v1.4.2-debian-elasticsearch-1.1ce4885865850
bundler@1.17.2
2.0.0
1
hickey/puppet_forge:1.10.0c1148a09ef20
bundler@1.15.4
2.0.0
1
huginn/huginn-single-process:4d17829cf6b15b004ad3f4be196303dca4944810c794eddc7b47
bundler@1.17.3
2.0.0
1
kubesphere/examples-bookinfo-details-v1:1.13.0108d022f64f0
bundler@1.17.2
2.0.0
1
mirrorgitlabcontainers/gitaly:v13.2.283599461ef8b
bundler@1.16.6
2.0.0
1
mirrorgitlabcontainers/gitlab-shell:v13.3.09f3654f1eafc
bundler@1.17.3
2.0.0
1
mirrorgitlabcontainers/gitlab-sidekiq-ce:v13.2.294d1431683fa
bundler@1.16.6
2.0.0
1
mirrorgitlabcontainers/gitlab-task-runner-ce:v13.2.29efd73993c34
bundler@1.16.6
2.0.0
1
mirrorgitlabcontainers/gitlab-webservice-ce:v13.2.230393f990f5c
bundler@1.16.6
2.0.0
1
mirrorgitlabcontainers/gitlab-workhorse-ce:v13.2.2a6d7bf42805a
bundler@1.16.6
2.0.0
1
pactfoundation/pact-broker:2.32.0-2062d6c710099
bundler@1.17.2
2.0.0
1
pactfoundation/pact-broker:2.79.1.112861b0bd4d9
bundler@1.17.2
2.0.0
1
zammad/zammad-docker-compose:zammad-4.1.0-312808e2dfa810
bundler@1.17.2
2.0.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.