csaf_suse - suse-su-2018:1994-1

SUSE-SU-2018:1994-1

Vulnerability from csaf_suse - Published: 2018-07-19 07:35 - Updated: 2018-07-19 07:35

Summary

Security update for rubygem-sprockets

Notes

Title of the patch

Security update for rubygem-sprockets

Description of the patch

This update for rubygem-sprockets fixes the following issues: The following security vulnerability was addressed: - CVE-2018-3760: Fixed a path traversal issue in sprockets/server.rb:forbidden_request?(), which allowed remote attackers to read arbitrary files (bsc#1098369)

Patchnames

SUSE-SLE-Product-HA-15-2018-1349

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for rubygem-sprockets",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for rubygem-sprockets fixes the following issues:\n\nThe following security vulnerability was addressed:\n\n- CVE-2018-3760: Fixed a path traversal issue in sprockets/server.rb:forbidden_request?(), which allowed remote attackers to read arbitrary files (bsc#1098369)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-Product-HA-15-2018-1349",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2018_1994-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2018:1994-1",
        "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181994-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2018:1994-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2018-July/004288.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1098369",
        "url": "https://bugzilla.suse.com/1098369"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-3760 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-3760/"
      }
    ],
    "title": "Security update for rubygem-sprockets",
    "tracking": {
      "current_release_date": "2018-07-19T07:35:45Z",
      "generator": {
        "date": "2018-07-19T07:35:45Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2018:1994-1",
      "initial_release_date": "2018-07-19T07:35:45Z",
      "revision_history": [
        {
          "date": "2018-07-19T07:35:45Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ruby2.5-rubygem-sprockets-3.7.2-3.3.1.aarch64",
                "product": {
                  "name": "ruby2.5-rubygem-sprockets-3.7.2-3.3.1.aarch64",
                  "product_id": "ruby2.5-rubygem-sprockets-3.7.2-3.3.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ruby2.5-rubygem-sprockets-3.7.2-3.3.1.ppc64le",
                "product": {
                  "name": "ruby2.5-rubygem-sprockets-3.7.2-3.3.1.ppc64le",
                  "product_id": "ruby2.5-rubygem-sprockets-3.7.2-3.3.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ruby2.5-rubygem-sprockets-3.7.2-3.3.1.s390x",
                "product": {
                  "name": "ruby2.5-rubygem-sprockets-3.7.2-3.3.1.s390x",
                  "product_id": "ruby2.5-rubygem-sprockets-3.7.2-3.3.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ruby2.5-rubygem-sprockets-3.7.2-3.3.1.x86_64",
                "product": {
                  "name": "ruby2.5-rubygem-sprockets-3.7.2-3.3.1.x86_64",
                  "product_id": "ruby2.5-rubygem-sprockets-3.7.2-3.3.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Availability Extension 15",
                "product": {
                  "name": "SUSE Linux Enterprise High Availability Extension 15",
                  "product_id": "SUSE Linux Enterprise High Availability Extension 15",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-ha:15"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby2.5-rubygem-sprockets-3.7.2-3.3.1.aarch64 as component of SUSE Linux Enterprise High Availability Extension 15",
          "product_id": "SUSE Linux Enterprise High Availability Extension 15:ruby2.5-rubygem-sprockets-3.7.2-3.3.1.aarch64"
        },
        "product_reference": "ruby2.5-rubygem-sprockets-3.7.2-3.3.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Availability Extension 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby2.5-rubygem-sprockets-3.7.2-3.3.1.ppc64le as component of SUSE Linux Enterprise High Availability Extension 15",
          "product_id": "SUSE Linux Enterprise High Availability Extension 15:ruby2.5-rubygem-sprockets-3.7.2-3.3.1.ppc64le"
        },
        "product_reference": "ruby2.5-rubygem-sprockets-3.7.2-3.3.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise High Availability Extension 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby2.5-rubygem-sprockets-3.7.2-3.3.1.s390x as component of SUSE Linux Enterprise High Availability Extension 15",
          "product_id": "SUSE Linux Enterprise High Availability Extension 15:ruby2.5-rubygem-sprockets-3.7.2-3.3.1.s390x"
        },
        "product_reference": "ruby2.5-rubygem-sprockets-3.7.2-3.3.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise High Availability Extension 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby2.5-rubygem-sprockets-3.7.2-3.3.1.x86_64 as component of SUSE Linux Enterprise High Availability Extension 15",
          "product_id": "SUSE Linux Enterprise High Availability Extension 15:ruby2.5-rubygem-sprockets-3.7.2-3.3.1.x86_64"
        },
        "product_reference": "ruby2.5-rubygem-sprockets-3.7.2-3.3.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Availability Extension 15"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2018-3760",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-3760"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application\u0027s root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise High Availability Extension 15:ruby2.5-rubygem-sprockets-3.7.2-3.3.1.aarch64",
          "SUSE Linux Enterprise High Availability Extension 15:ruby2.5-rubygem-sprockets-3.7.2-3.3.1.ppc64le",
          "SUSE Linux Enterprise High Availability Extension 15:ruby2.5-rubygem-sprockets-3.7.2-3.3.1.s390x",
          "SUSE Linux Enterprise High Availability Extension 15:ruby2.5-rubygem-sprockets-3.7.2-3.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-3760",
          "url": "https://www.suse.com/security/cve/CVE-2018-3760"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1098369 for CVE-2018-3760",
          "url": "https://bugzilla.suse.com/1098369"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1182167 for CVE-2018-3760",
          "url": "https://bugzilla.suse.com/1182167"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise High Availability Extension 15:ruby2.5-rubygem-sprockets-3.7.2-3.3.1.aarch64",
            "SUSE Linux Enterprise High Availability Extension 15:ruby2.5-rubygem-sprockets-3.7.2-3.3.1.ppc64le",
            "SUSE Linux Enterprise High Availability Extension 15:ruby2.5-rubygem-sprockets-3.7.2-3.3.1.s390x",
            "SUSE Linux Enterprise High Availability Extension 15:ruby2.5-rubygem-sprockets-3.7.2-3.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise High Availability Extension 15:ruby2.5-rubygem-sprockets-3.7.2-3.3.1.aarch64",
            "SUSE Linux Enterprise High Availability Extension 15:ruby2.5-rubygem-sprockets-3.7.2-3.3.1.ppc64le",
            "SUSE Linux Enterprise High Availability Extension 15:ruby2.5-rubygem-sprockets-3.7.2-3.3.1.s390x",
            "SUSE Linux Enterprise High Availability Extension 15:ruby2.5-rubygem-sprockets-3.7.2-3.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-07-19T07:35:45Z",
          "details": "important"
        }
      ],
      "title": "CVE-2018-3760"
    }
  ]
}

CVE-2018-3760 (GCVE-0-2018-3760)

Vulnerability from cvelistv5 – Published: 2018-06-26 19:00 – Updated: 2024-09-16 18:39

Summary

There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.

Severity ?

No CVSS data available.

CWE

CWE-22 - Path Traversal (CWE-22)

Assigner

hackerone

References

URL

Tags

	https://github.com/rails/sprockets/commit/c09131c…	x_refsource_MISC
	https://access.redhat.com/errata/RHSA-2018:2745	vendor-advisoryx_refsource_REDHAT
	https://groups.google.com/d/msg/rubyonrails-secur…	x_refsource_MISC
	https://access.redhat.com/errata/RHSA-2018:2244	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2018:2561	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2018:2245	vendor-advisoryx_refsource_REDHAT
	https://www.debian.org/security/2018/dsa-4242	vendor-advisoryx_refsource_DEBIAN

Impacted products

	Vendor	Product	Version
	HackerOne	Sprockets	Affected: 4.0.0.beta8, 3.7.2, 2.12.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T04:50:30.511Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rails/sprockets/commit/c09131cf5b2c479263939c8582e22b98ed616c5fhttps://github.com/rails/sprockets/commit/9c34fa05900b968d74f08ccf40917848a7be9441https://github.com/rails/sprockets/commit/18b8a7f07a50c245e9aee7854ecdbe606bbd8bb5"
          },
          {
            "name": "RHSA-2018:2745",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2745"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://groups.google.com/d/msg/rubyonrails-security/ft_J--l55fM/7roDfQ50BwAJ"
          },
          {
            "name": "RHSA-2018:2244",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2244"
          },
          {
            "name": "RHSA-2018:2561",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2561"
          },
          {
            "name": "RHSA-2018:2245",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2245"
          },
          {
            "name": "DSA-4242",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4242"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Sprockets",
          "vendor": "HackerOne",
          "versions": [
            {
              "status": "affected",
              "version": "4.0.0.beta8, 3.7.2, 2.12.5"
            }
          ]
        }
      ],
      "datePublic": "2018-06-19T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application\u0027s root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Path Traversal (CWE-22)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-09-27T09:57:01",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rails/sprockets/commit/c09131cf5b2c479263939c8582e22b98ed616c5fhttps://github.com/rails/sprockets/commit/9c34fa05900b968d74f08ccf40917848a7be9441https://github.com/rails/sprockets/commit/18b8a7f07a50c245e9aee7854ecdbe606bbd8bb5"
        },
        {
          "name": "RHSA-2018:2745",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2745"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://groups.google.com/d/msg/rubyonrails-security/ft_J--l55fM/7roDfQ50BwAJ"
        },
        {
          "name": "RHSA-2018:2244",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2244"
        },
        {
          "name": "RHSA-2018:2561",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2561"
        },
        {
          "name": "RHSA-2018:2245",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2245"
        },
        {
          "name": "DSA-4242",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4242"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "support@hackerone.com",
          "DATE_PUBLIC": "2018-06-19T00:00:00",
          "ID": "CVE-2018-3760",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Sprockets",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "4.0.0.beta8, 3.7.2, 2.12.5"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "HackerOne"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application\u0027s root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Path Traversal (CWE-22)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/rails/sprockets/commit/c09131cf5b2c479263939c8582e22b98ed616c5fhttps://github.com/rails/sprockets/commit/9c34fa05900b968d74f08ccf40917848a7be9441https://github.com/rails/sprockets/commit/18b8a7f07a50c245e9aee7854ecdbe606bbd8bb5",
              "refsource": "MISC",
              "url": "https://github.com/rails/sprockets/commit/c09131cf5b2c479263939c8582e22b98ed616c5fhttps://github.com/rails/sprockets/commit/9c34fa05900b968d74f08ccf40917848a7be9441https://github.com/rails/sprockets/commit/18b8a7f07a50c245e9aee7854ecdbe606bbd8bb5"
            },
            {
              "name": "RHSA-2018:2745",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2745"
            },
            {
              "name": "https://groups.google.com/d/msg/rubyonrails-security/ft_J--l55fM/7roDfQ50BwAJ",
              "refsource": "MISC",
              "url": "https://groups.google.com/d/msg/rubyonrails-security/ft_J--l55fM/7roDfQ50BwAJ"
            },
            {
              "name": "RHSA-2018:2244",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2244"
            },
            {
              "name": "RHSA-2018:2561",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2561"
            },
            {
              "name": "RHSA-2018:2245",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2245"
            },
            {
              "name": "DSA-4242",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4242"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2018-3760",
    "datePublished": "2018-06-26T19:00:00Z",
    "dateReserved": "2017-12-28T00:00:00",
    "dateUpdated": "2024-09-16T18:39:20.968Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

SUSE-SU-2018:1994-1

CVE-2018-3760 (GCVE-0-2018-3760)

Tags

Sightings

Nomenclature