CVE-2018-3760

Опубликовано: 26 июн. 2018

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Критический

Описание

There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.

Ссылки

https://access.redhat.com/errata/RHSA-2018:2244
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2245
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2561
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2745
Third Party Advisory
https://github.com/rails/sprockets/commit/c09131cf5b2c479263939c8582e22b98ed616c5fhttps://github.com/rails/sprockets/commit/9c34fa05900b968d74f08ccf40917848a7be9441https://github.com/rails/sprockets/commit/18b8a7f07a50c245e9aee7854ecdbe606bbd8bb5
Broken Link
https://groups.google.com/d/msg/rubyonrails-security/ft_J--l55fM/7roDfQ50BwAJ
Patch
Third Party Advisory
https://www.debian.org/security/2018/dsa-4242
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2244
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2245
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2561
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2745
Third Party Advisory
https://github.com/rails/sprockets/commit/c09131cf5b2c479263939c8582e22b98ed616c5fhttps://github.com/rails/sprockets/commit/9c34fa05900b968d74f08ccf40917848a7be9441https://github.com/rails/sprockets/commit/18b8a7f07a50c245e9aee7854ecdbe606bbd8bb5
Broken Link
https://groups.google.com/d/msg/rubyonrails-security/ft_J--l55fM/7roDfQ50BwAJ
Patch
Third Party Advisory
https://www.debian.org/security/2018/dsa-4242
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:redhat:cloudforms:4.5:*:*:*:*:*:*:*

cpe:2.3:a:redhat:cloudforms:4.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:6.7:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.5:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.6:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:a:sprockets_project:sprockets:*:*:*:*:*:*:*:*

Версия от 2.0.0 (включая) до 2.12.4 (включая)

cpe:2.3:a:sprockets_project:sprockets:*:*:*:*:*:*:*:*

Версия от 3.0.0 (включая) до 3.7.1 (включая)

cpe:2.3:a:sprockets_project:sprockets:4.0.0:beta1:*:*:*:*:*:*

cpe:2.3:a:sprockets_project:sprockets:4.0.0:beta2:*:*:*:*:*:*

cpe:2.3:a:sprockets_project:sprockets:4.0.0:beta3:*:*:*:*:*:*

cpe:2.3:a:sprockets_project:sprockets:4.0.0:beta4:*:*:*:*:*:*

cpe:2.3:a:sprockets_project:sprockets:4.0.0:beta5:*:*:*:*:*:*

cpe:2.3:a:sprockets_project:sprockets:4.0.0:beta6:*:*:*:*:*:*

cpe:2.3:a:sprockets_project:sprockets:4.0.0:beta7:*:*:*:*:*:*

Конфигурация 3

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

EPSS

Процентиль: 100%

0.93887

Критический

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-22

CWE-200

Связанные уязвимости

CVE-2018-3760

CVSS3: 7.5

ubuntu

больше 7 лет назад

CVE-2018-3760

CVSS3: 7.5

redhat

больше 7 лет назад

CVE-2018-3760

CVSS3: 7.5

debian

больше 7 лет назад

There is an information leak vulnerability in Sprockets. Versions Affe ...

openSUSE-SU-2018:2124-1

suse-cvrf

больше 7 лет назад

Security update for rubygem-sprockets

openSUSE-SU-2018:1854-1

suse-cvrf

больше 7 лет назад

Security update for rubygem-sprockets

EPSS

Процентиль: 100%

0.93887

Критический

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-22

CWE-200