UBUNTU-CVE-2018-3760: High severity ubuntu/ruby-sprockets vulnerability

Q: Who is exposed to this issue?

Applications running an affected ruby-sprockets release are exposed when the Sprockets server is used in production. The affected version ranges are 4.0.0.beta7 and earlier, 3.7.1 and earlier, and 2.12.4 and earlier.

Q: What does an attacker need to exploit it?

An attacker can exploit the issue with specially crafted requests. No privileges or user interaction are required according to the supplied severity vector.

Q: What can be done if an immediate upgrade is not possible?

Use one of the available workarounds immediately. The provided data does not specify the workaround steps.

Q: How can I determine whether my application is affected?

Check the installed ruby-sprockets version and whether the application uses the Sprockets server in production. Systems meeting both conditions within an affected version range should be treated as vulnerable.

Published Jun 26, 2018

Updated

There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.

Affected Software

2 affected componentsFixes available

ubuntu/ruby-sprockets*

ubuntu/ruby-sprockets<3.7.0-1+deb9u1build0.18.04.1

3.7.0-1+deb9u1build0.18.04.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/ruby-sprockets to a version that resolves this vulnerability.
Fixed in 3.7.0-1+deb9u1build0.18.04.1

Event History

Jun 26, 2018

CVE Published

via OSV·07:29 PM

Data Sourced

via OSV·07:29 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Applications running an affected ruby-sprockets release are exposed when the Sprockets server is used in production. The affected version ranges are 4.0.0.beta7 and earlier, 3.7.1 and earlier, and 2.12.4 and earlier.

What does an attacker need to exploit it?

An attacker can exploit the issue with specially crafted requests. No privileges or user interaction are required according to the supplied severity vector.

What can be done if an immediate upgrade is not possible?

Use one of the available workarounds immediately. The provided data does not specify the workaround steps.

How can I determine whether my application is affected?

Check the installed ruby-sprockets version and whether the application uses the Sprockets server in production. Systems meeting both conditions within an affected version range should be treated as vulnerable.

UBUNTU-CVE-2018-3760: High severity ubuntu/ruby-sprockets vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What can be done if an immediate upgrade is not possible?

How can I determine whether my application is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What can be done if an immediate upgrade is not possible?

How can I determine whether my application is affected?