Güvenlik Danışarlıklarına Dön

Sprockets Vulnerability — Ubuntu Security Update (USN-8990-1)

USN-8990-1 fixes CVE-2018-3760 in Sprockets on Ubuntu — path traversal (CWE-22) when the Sprockets server mode ran in production, letting a remote attacker read arbitrary files outside the intended asset directory. Update: sudo apt update && sudo apt upgrade ruby-sprockets and restart the application. CVSS 7.5.

High 7.5 CVSS
Ubuntu 20.04 Ubuntu 22.04

SharedLicense lisansı altında bunun anlamı

Path traversal in an asset server reads arbitrary files as the application user — source code, configuration files with secrets, and environment files are all readable targets.

  1. Ubuntu Security Notices

  2. USN-8990-1

Publication date

3 November 2026

Overview

Sprockets would allow unintended access to files over the network.

Releases


16.04 LTS

Packages

Details

It was discovered that Sprockets incorrectly handled certain specially
crafted requests when the Sprockets server was used in production. A remote
attacker could possibly use this issue to access files outside of the
application’s root directory.

It was discovered that Sprockets incorrectly handled certain specially
crafted requests when the Sprockets server was used in production. A remote
attacker could possibly use this issue to access files outside of the
application’s root directory.

Update instructions

After a standard system update you need to restart any applications using
Sprockets to make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
16.04 LTS xenial ruby-sprockets –  3.3.0-1ubuntu0.1~esm1

References

Sıkça Sorulan Sorular

What is CVE-2018-3760?
It is a path traversal vulnerability (CWE-22) in Sprockets — the Ruby asset pipeline — when its server mode ran in production: crafted requests could read files outside the asset directory. CVSS 7.5; fixed in USN-8990-1 (an old CVE backported to Ubuntu's packaged version).
Who is affected?
Ubuntu systems with the packaged ruby-sprockets running Rails or Rack applications in production with Sprockets server mode enabled — older Ruby stacks are the typical case.
How do I apply the fix?
Run sudo apt update && sudo apt upgrade ruby-sprockets and restart the application. Verify no requests for crafted asset paths appear in access logs before the fix window.
Why is a 2018 CVE appearing now?
Ubuntu backports fixes into its packaged library versions on its own schedule — old CVEs arrive when the backport window opens. The practical instruction is unchanged: apply the current update.

Referanslar

Güvenlik Danışarlıkları

İlgili Danışarlıklar

Linux Kernel (HWE) Vulnerabilities — Ubuntu Security Update (USN-9018-2)

2026-11-12

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

Sisteminizi güvenlik açıkları açısından kontrol edin

Size uygun tam düzeltme komutlarını görmek için ürününüzü ve işletim sisteminizi seçin.

Sisteminizi Kontrol Edin