MEDIUM
GHSA-33pp-3763-mrfp
sprockets vulnerable to Path Traversal
Quick fix
GHSA-33pp-3763-mrfp — sprockets: upgrade to the fixed version with the command below.
bundle update sprocketsDetails
Multiple directory traversal vulnerabilities in `server.rb` in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://nvd.nist.gov/vuln/detail/CVE-2014-7819[ADVISORY]
- https://access.redhat.com/errata/RHBA-2015:1100[WEB]
- https://access.redhat.com/security/cve/CVE-2014-7819[WEB]
- https://bugzilla.redhat.com/show_bug.cgi?id=1161527[WEB]
- https://groups.google.com/forum/#!topic/rubyonrails-security/doAVp0YaTqY[WEB]
- https://groups.google.com/forum/message/raw?msg=rubyonrails-security/doAVp0YaTqY/aHFngBqNBoAJ[WEB]
- https://groups.google.com/forum/message/raw?msg=rubyonrails-security/wQBeGXqGs3E/JqUMB6fhh3gJ[WEB]
- http://lists.opensuse.org/opensuse-updates/2014-11/msg00103.html[WEB]
- http://lists.opensuse.org/opensuse-updates/2014-11/msg00105.html[WEB]
- http://lists.opensuse.org/opensuse-updates/2014-11/msg00110.html[WEB]
- http://lists.opensuse.org/opensuse-updates/2014-11/msg00111.html[WEB]