netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish GHSA-pr3h-jjhj-573x

Browse Source
This commit is contained in:
advisory-database[bot]
2023-09-05 21:07:04 +00:00
parent ac50002475
commit 3f2c41d13e
1 changed files with 17 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2018/06/GHSA-pr3h-jjhj-573x/GHSA-pr3h-jjhj-573x.json
+17 -2
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pr3h-jjhj-573x",
"modified": "2022-07-29T19:53:42Z",
"modified": "2023-09-05T21:05:18Z",
"published": "2018-06-20T22:18:58Z",
"aliases": [
"CVE-2018-3760"
],
"summary": "Sprockets path traversal leads to information leak",
"details": "Specially crafted requests can be used to access files that exist on the filesystem that is outside an application's root directory, when the Sprockets server is used in production.\n \nAll users running an affected release should either upgrade or use one of the work arounds immediately.\n \nWorkaround:\n \nIn Rails applications, work around this issue, set `config.assets.compile = false` and `config.public_file_server.enabled = true` in an initializer and precompile the assets.\n\nThis work around will not be possible in all hosting environments and upgrading is advised.",
"details": "Specially crafted requests can be used to access files that exist on the filesystem that is outside an application's root directory, when the Sprockets server is used in production.\n \nAll users running an affected release should either upgrade or use one of the work arounds immediately.\n \n### Workaround:\n \nIn Rails applications, work around this issue, set `config.assets.compile = false` and `config.public_file_server.enabled = true` in an initializer and precompile the assets.\n\nThis work around will not be possible in all hosting environments and upgrading is advised.",
"severity": [
{
"type": "CVSS_V3",
@@ -20,6 +20,11 @@
"ecosystem": "RubyGems",
"name": "sprockets"
},
"ecosystem_specific": {
"affected_functions": [
""
]
},
"ranges": [
{
"type": "ECOSYSTEM",
@@ -39,6 +44,11 @@
"ecosystem": "RubyGems",
"name": "sprockets"
},
"ecosystem_specific": {
"affected_functions": [
""
]
},
"ranges": [
{
"type": "ECOSYSTEM",
@@ -61,6 +71,11 @@
"ecosystem": "RubyGems",
"name": "sprockets"
},
"ecosystem_specific": {
"affected_functions": [
""
]
},
"ranges": [
{
"type": "ECOSYSTEM",