CVE-2018-3760
1 advisory.
RubyGems/sprockets CVE-2018-3760: high 7.5
Sprockets path traversal leads to information leak
Action: Upgrade sprockets to 2.12.5 or later.
bundle update sprocketsAffected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0 | 3.7.2 | - |
| 4.0.0.beta1 | 4.0.0.beta8 | - |
| 0 | 2.12.5 | - |
Fixed versions
| 3.7.2 | 4.0.0.beta8 | 2.12.5 |
Sources
- osv: GHSA-pr3h-jjhj-573x
- https://nvd.nist.gov/vuln/detail/CVE-2018-3760
- https://github.com/rails/sprockets/commit/18b8a7f07a50c245e9aee7854ecdbe606bbd8bb5
- https://github.com/rails/sprockets/commit/9c34fa05900b968d74f08ccf40917848a7be9441
- https://github.com/rails/sprockets/commit/c09131cf5b2c479263939c8582e22b98ed616c5f
- https://access.redhat.com/errata/RHSA-2018:2244
- https://access.redhat.com/errata/RHSA-2018:2245
- https://access.redhat.com/errata/RHSA-2018:2561
- https://access.redhat.com/errata/RHSA-2018:2745
- https://github.com/rails/sprockets
- https://groups.google.com/d/msg/rubyonrails-security/ft_J--l55fM/7roDfQ50BwAJ
- https://www.debian.org/security/2018/dsa-4242
CVE-2018-3760 · published · modified · JSON