CVE-2018-3760

NameCVE-2018-3760
DescriptionThere is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1419-1, DSA-4242-1
Debian Bugs901913

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ruby-sprockets (PTS)jessie2.12.3-1vulnerable
jessie (security)2.12.3-1+deb8u1fixed
stretch3.7.0-1vulnerable
stretch (security)3.7.0-1+deb9u1fixed
buster, sid3.7.2-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ruby-sprocketssource(unstable)3.7.0-1.1901913
ruby-sprocketssourcejessie2.12.3-1+deb8u1DLA-1419-1
ruby-sprocketssourcestretch3.7.0-1+deb9u1DSA-4242-1

Notes

http://www.openwall.com/lists/oss-security/2018/06/19/2
https://github.com/rails/sprockets/commit/c09131cf5b2c479263939c8582e22b98ed616c5f (master)
https://github.com/rails/sprockets/commit/9c34fa05900b968d74f08ccf40917848a7be9441 (3.x)
https://github.com/rails/sprockets/commit/18b8a7f07a50c245e9aee7854ecdbe606bbd8bb5 (2.x)

Search for package or bug name: Reporting problems