Red Hat Bugzilla – Bug 1161527
CVE-2014-7819 rubygem-sprockets: arbitrary file existence disclosure
Last modified: 2016-04-26 23:02:11 EDT
The following Ruby on Rails issue was reported[1]: "" Arbitrary file existence disclosure in Sprockets There is an information leak vulnerability in Sprockets. This vulnerability has been assigned the CVE identifier CVE-2014-7819. Versions Affected: ALL Not affected: NONE Fixed Versions: 3.0.0.beta.3, 2.12.3, 2.11.3, 2.10.2, 2.9.4, 2.8.3, 2.7.1, 2.5.1, 2.4.6, 2.3.3, 2.2.3, 2.1.4, 2.0.5 Impact ------ Specially crafted requests can be used to determine whether a file exists on the filesystem that is outside an application's root directory. The files will not be served, but attackers can determine whether or not the file exists. All users running an affected release should either upgrade or use one of the work arounds immediately. Releases -------- The 2.12.X releases are available at the normal locations. Workarounds ----------- In Rails applications, work around this issue, set config.serve_static_assets = false in an initializer. This work around will not be possible in all hosting environments and upgrading is advised. "" [1] https://groups.google.com/forum/#!topic/rubyonrails-security/doAVp0YaTqY
External References: https://groups.google.com/forum/#!topic/rubyonrails-security/doAVp0YaTqY
Upstream patch: https://github.com/sstephenson/sprockets/commit/9c9da3b8a25174721a04e988f904b7dc3d7343d1
Acknowledgements: Red Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Eaden McKee, Dennis Hackethal & Christian Hansen of Crowdcurity, Juan C. Müller & Mike McClurg of Greenhouse.io , and Alex Ianus of Coinbase as the independent, original reporters.
Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Created rubygem-sprockets tracking bugs for this issue: Affects: fedora-all [bug 1164331]