| Name | CVE-2014-0130 |
| Description | Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DSA-2929-1 |
| Debian Bugs | 747380, 747382 |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| rails-3.2 | source | (unstable) | 3.2.18-1 | 747382 | ||
| rails-4.0 | source | (unstable) | (unfixed) | 747380 | ||
| ruby-actionpack-2.3 | source | (unstable) | (not affected) | |||
| ruby-actionpack-3.2 | source | wheezy | 3.2.6-6+deb7u2 | DSA-2929-1 | ||
| ruby-actionpack-3.2 | source | (unstable) | (unfixed) | 747382 |
- ruby-actionpack-2.3 <not-affected> (Vulnerable code not present)