This package is not in any development repository. This probably
means that the package
has been removed
(or has been renamed). Thus the information here is of little interest ...
the package is going to disappear unless someone takes it over and
reintroduces it.
1 issue left for the package maintainer to handle:
CVE-2020-36327:
(needs triaging)
Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every "Dependency Confusion" issue in every product.
CVE-2016-7954:
Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2013-0334.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/b/bundler.png){kind=link}