CVE-2014-0130

NameCVE-2014-0130
DescriptionDirectory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.
SourceCVE (at NVD; oss-sec, fulldisc, OSVDB, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, more)
ReferencesDSA-2929-1
NVD severitymedium (attack range: remote)
Debian Bugs747380, 747382
Debian/oldoldstablenot known to be vulnerable.
Debian/oldstablenot vulnerable.
Debian/stablenot known to be vulnerable.
Debian/testingnot known to be vulnerable.
Debian/unstablenot known to be vulnerable.

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ruby-actionpack-2.3 (PTS)wheezy2.3.14-5fixed
ruby-actionpack-3.2 (PTS)wheezy, wheezy (security)3.2.6-6+deb7u2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
rails-3.2source(unstable)3.2.18-1medium747382
rails-4.0source(unstable)(unfixed)medium747380
ruby-actionpack-2.3source(unstable)(not affected)
ruby-actionpack-3.2source(unstable)(unfixed)medium747382
ruby-actionpack-3.2sourcewheezy3.2.6-6+deb7u2mediumDSA-2929-1

Notes

- ruby-actionpack-2.3 <not-affected> (Vulnerable code not present)

Search for package or bug name: Reporting problems