Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in
    Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4,
    when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside
    the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.
    (CVE-2014-7829)

Fixes for CVE-2014-7818 (rhbz#1163511) and CVE-2014-7829 (rhbz#1165077)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

rubygem-actionpack-3_2 was updated to fix two security issues.

These security issues were fixed :

  - Arbitrary file existence disclosure (CVE-2014-7829).

  - Arbitrary file existence disclosure (CVE-2014-7818).

ID	Name	Product	Family	Severity
422548	SCA: security update for actionpack (GHSA-h56m-vwxc-3qpw)	Tenable Cloud Security	SCA Checks	medium
422548	SCA: security update for actionpack (GHSA-h56m-vwxc-3qpw)	Tenable Self-Hosted Container Security	SCA Checks	medium
81655	Fedora 20 : rubygem-actionpack-4.0.0-5.fc20 (2014-15371)	Nessus	Fedora Local Security Checks	medium
81343	Fedora 21 : rubygem-actionpack-4.1.5-2.fc21 (2014-15342)	Nessus	Fedora Local Security Checks	medium
79617	openSUSE Security Update : rubygem-actionpack-3_2 (openSUSE-SU-2014:1515-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2014-7829

medium

Tenable Plugins

medium

medium

medium

medium

medium