{"action":"Upgrade sprockets to 2.0.5 or later.","affected":[{"fixed":"2.0.5","introduced":"0"},{"fixed":"2.1.4","introduced":"2.1.0"},{"fixed":"2.2.3","introduced":"2.2.0"},{"fixed":"2.3.3","introduced":"2.3.0"},{"fixed":"2.4.6","introduced":"2.4.0"},{"fixed":"2.5.1","introduced":"2.5.0"},{"fixed":"2.7.1","introduced":"2.6.0"},{"fixed":"2.8.3","introduced":"2.8.0"},{"fixed":"2.9.4","introduced":"2.9.0"},{"fixed":"2.10.2","introduced":"2.10.0"},{"fixed":"2.11.3","introduced":"2.11.0"},{"fixed":"2.12.3","introduced":"2.12.0"}],"component":"sprockets","cve_ids":["CVE-2014-7819"],"ecosystem":"RubyGems","epss":0.03892,"exploited":false,"fixed_versions":["2.0.5","2.1.4","2.2.3","2.3.3","2.4.6","2.5.1","2.7.1","2.8.3","2.9.4","2.10.2","2.11.3","2.12.3"],"ghsa_id":"GHSA-33pp-3763-mrfp","id":"tcs_01M5KEG4V5NH2JSVG82AXKPP0A","modified_at":"2024-11-28T05:27:03.081760Z","published_at":"2017-10-24T18:33:36Z","references":["https://osv.dev/vulnerability/GHSA-33pp-3763-mrfp","https://nvd.nist.gov/vuln/detail/CVE-2014-7819","https://access.redhat.com/errata/RHBA-2015:1100","https://access.redhat.com/security/cve/CVE-2014-7819","https://bugzilla.redhat.com/show_bug.cgi?id=1161527","https://groups.google.com/forum/#!topic/rubyonrails-security/doAVp0YaTqY","https://groups.google.com/forum/message/raw?msg=rubyonrails-security/doAVp0YaTqY/aHFngBqNBoAJ","https://groups.google.com/forum/message/raw?msg=rubyonrails-security/wQBeGXqGs3E/JqUMB6fhh3gJ","http://lists.opensuse.org/opensuse-updates/2014-11/msg00103.html","http://lists.opensuse.org/opensuse-updates/2014-11/msg00105.html","http://lists.opensuse.org/opensuse-updates/2014-11/msg00110.html","http://lists.opensuse.org/opensuse-updates/2014-11/msg00111.html"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-33pp-3763-mrfp","url":"https://osv.dev/vulnerability/GHSA-33pp-3763-mrfp"}],"summary":"sprockets vulnerable to Path Traversal"}