Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4,
    2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before
    2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before
    2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers
    to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with
    (1) double slashes or (2) URL encoding. (CVE-2014-7819)

Contains fix for CVE-2014-7819 rubygem-sprockets: arbitrary file existence disclosure

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

rubygem-sprockets was updated to fix one security issue.

This security issue was fixed :

  - Arbitrary file existence disclosure (CVE-2014-7819).

To enable this update rubygem-tilt-1_4 was added to openSUSE and installed with the update.

rubygem-sprockets was updated to fix one security issue.

This security issue was fixed :

  - Arbitrary file existence disclosure (CVE-2014-7819).

rubygem-sprockets-2_1 was updated to fix one security issue.

This security issue was fixed :

  - Arbitrary file existence disclosure (CVE-2014-7819).

rubygem-sprockets-2_2 was updated to fix one security issue.

This security issue was fixed :

  - Arbitrary file existence disclosure (CVE-2014-7819).

ID	Name	Product	Family	Severity
422739	SCA: security update for sprockets (GHSA-33pp-3763-mrfp)	Tenable Cloud Security	SCA Checks	medium
422739	SCA: security update for sprockets (GHSA-33pp-3763-mrfp)	Tenable Self-Hosted Container Security	SCA Checks	medium
81345	Fedora 20 : rubygem-sprockets-2.8.2-5.fc20 (2014-15489)	Nessus	Fedora Local Security Checks	medium
81344	Fedora 21 : rubygem-sprockets-2.12.1-3.fc21 (2014-15413)	Nessus	Fedora Local Security Checks	medium
79615	openSUSE Security Update : rubygem-sprockets (openSUSE-SU-2014:1514-1)	Nessus	SuSE Local Security Checks	medium
79614	openSUSE Security Update : rubygem-sprockets (openSUSE-SU-2014:1513-1)	Nessus	SuSE Local Security Checks	medium
79591	openSUSE Security Update : rubygem-sprockets-2_1 (openSUSE-SU-2014:1502-1)	Nessus	SuSE Local Security Checks	medium
79590	openSUSE Security Update : rubygem-sprockets-2_2 (openSUSE-SU-2014:1504-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2014-7819

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium