Description
Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby-sprockets | 2.12.3-1 | — |
| Debian 13 | ruby-sprockets | 2.12.3-1 | — |
| Debian 12 | ruby-sprockets | 2.12.3-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat CloudForms 5 | cfme +3 | 5.4.0.5-1.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | cfme-vnc-plugin | 1.0.0-2.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | libdnet +2 | 1.12-11.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | lshw +1 | B.02.16-4.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | netapp-manageability-sdk +1 | 4.0P1-3.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | open-vm-tools +2 | 9.2.3-5.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | prince | 9.0r2-4.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | pyliblzma | 0.5.3-7.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | ruby200-rubygem-bcrypt-ruby | 3.0.1-2.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | ruby200-rubygem-eventmachine | 1.0.7-2.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | ruby200-rubygem-ffi | 1.9.8-1.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | ruby200-rubygem-io-extra | 1.2.8-1.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | ruby200-rubygem-json | 1.8.2-2.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | ruby200-rubygem-nokogiri | 1.5.11-2.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | ruby200-rubygem-pg | 0.12.2-9.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | ruby200-rubygem-psych | 2.0.13-1.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | ruby200-rubygem-qpid_messaging | 0.20.2-5.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | ruby200-rubygem-therubyracer | 0.11.0-5.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | ruby200-rubygem-thin | 1.3.1-9.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | sneakernet_ca | 0.1-2.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | wmi | 1.3.14-1.el6cf | RHBA-2015:1100 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | sprockets | < 2.0.5 | 2.0.5 | GHSA-33pp-3763-mrfp |
| RubyGems | sprockets | >= 2.1.0, < 2.1.4 | 2.1.4 | GHSA-33pp-3763-mrfp |
| RubyGems | sprockets | >= 2.2.0, < 2.2.3 | 2.2.3 | GHSA-33pp-3763-mrfp |
| RubyGems | sprockets | >= 2.3.0, < 2.3.3 | 2.3.3 | GHSA-33pp-3763-mrfp |
| RubyGems | sprockets | >= 2.4.0, < 2.4.6 | 2.4.6 | GHSA-33pp-3763-mrfp |
| RubyGems | sprockets | >= 2.5.0, < 2.5.1 | 2.5.1 | GHSA-33pp-3763-mrfp |
| RubyGems | sprockets | >= 2.6.0, < 2.7.1 | 2.7.1 | GHSA-33pp-3763-mrfp |
| RubyGems | sprockets | >= 2.8.0, < 2.8.3 | 2.8.3 | GHSA-33pp-3763-mrfp |
| RubyGems | sprockets | >= 2.9.0, < 2.9.4 | 2.9.4 | GHSA-33pp-3763-mrfp |
| RubyGems | sprockets | >= 2.10.0, < 2.10.2 | 2.10.2 | GHSA-33pp-3763-mrfp |
| RubyGems | sprockets | >= 2.11.0, < 2.11.3 | 2.11.3 | GHSA-33pp-3763-mrfp |
| RubyGems | sprockets | >= 2.12.0, < 2.12.3 | 2.12.3 | GHSA-33pp-3763-mrfp |
Advisories 1
- RHBA-2015:1100 Red Hat Bug Fix Advisory: CFME 5.4.0 bug fixes, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- openSUSE-SU-2014:1504 vendor-advisory
- openSUSE-SU-2014:1514 vendor-advisory
- [rubyonrails-security] 20141030 [AMENDED] [CVE-2014-7819] Arbitrary file existence disclosure in Sprockets mailing-list
- openSUSE-SU-2014:1502 vendor-advisory
- openSUSE-SU-2014:1513 vendor-advisory
- [rubyonrails-security] 20141030 Arbitrary file existence disclosure in Sprockets (CVE-2014-7819) mailing-list