{"id":"CVE-2014-7819","aliases":["DEBIAN-CVE-2014-7819","EUVD-2017-0153","GHSA-33pp-3763-mrfp","MGASA-2015-0074","RHBA-2015:1100","SUSE-SU-2015:0787-1","SUSE-SU-2015:0863-1","UBUNTU-CVE-2014-7819"],"status":"published","title":"sprockets vulnerable to Path Traversal","description":"Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.03892,"percentile":0.90312,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2014-11-08T11:00:00Z","modified":"2026-10-23T15:47:25Z","fixes":[{"ecosystem":"RubyGems","package":"sprockets","fixed_in":["2.0.5","2.1.4","2.2.3","2.3.3","2.4.6","2.5.1","2.7.1","2.8.3","2.9.4","2.10.2","2.11.3","2.12.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"ruby-sprockets","fixed_in":["2.12.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-sprockets","fixed_in":["2.12.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-sprockets","fixed_in":["2.12.3-1"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"ruby-sprockets","fixed_in":["2.10.0-4.1.mga4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"sprockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.5"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"sprockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.4"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"sprockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.3"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"sprockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.3"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"sprockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.6"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"sprockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.1"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"sprockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.7.1"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"sprockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0"},{"fixed":"2.8.3"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"sprockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.0"},{"fixed":"2.9.4"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"sprockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.0"},{"fixed":"2.10.2"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"sprockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.0"},{"fixed":"2.11.3"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"sprockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.0"},{"fixed":"2.12.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-sprockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-sprockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-sprockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.3-1"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"sprockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.5"}]}],"versions":["0.9.0","0.9.1","1.0.0","1.0.1","1.0.2","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4"]},{"source":"osv","ecosystem":"RubyGems","package":"sprockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.4"}]}],"versions":["2.1.0","2.1.1","2.1.2","2.1.3"]},{"source":"osv","ecosystem":"RubyGems","package":"sprockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.3"}]}],"versions":["2.2.0","2.2.1","2.2.2"]},{"source":"osv","ecosystem":"RubyGems","package":"sprockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.3"}]}],"versions":["2.3.0","2.3.1","2.3.2"]},{"source":"osv","ecosystem":"RubyGems","package":"sprockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.6"}]}],"versions":["2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5"]},{"source":"osv","ecosystem":"RubyGems","package":"sprockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.1"}]}],"versions":["2.5.0"]},{"source":"osv","ecosystem":"RubyGems","package":"sprockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.7.1"}]}],"versions":["2.6.0","2.6.1","2.7.0"]},{"source":"osv","ecosystem":"RubyGems","package":"sprockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0"},{"fixed":"2.8.3"}]}],"versions":["2.8.0","2.8.1","2.8.2"]},{"source":"osv","ecosystem":"RubyGems","package":"sprockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.0"},{"fixed":"2.9.4"}]}],"versions":["2.9.0","2.9.2","2.9.3"]},{"source":"osv","ecosystem":"RubyGems","package":"sprockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.0"},{"fixed":"2.10.2"}]}],"versions":["2.10.0","2.10.1"]},{"source":"osv","ecosystem":"RubyGems","package":"sprockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.0"},{"fixed":"2.11.3"}]}],"versions":["2.11.0"]},{"source":"osv","ecosystem":"RubyGems","package":"sprockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.0"},{"fixed":"2.12.3"}]}],"versions":["2.12.0","2.12.1","2.12.2"]},{"source":"osv","ecosystem":"Mageia:4","package":"ruby-sprockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0-4.1.mga4"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"cfme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.4.0.5-1.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"cfme-appliance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.4.0.5-1.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"cfme-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.4.0.5-1.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"cfme-gemset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.4.0.5-1.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"cfme-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.4.0.5-1.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"cfme-vnc-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-2.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"cfme-vnc-plugin-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-2.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"libdnet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12-11.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"libdnet-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12-11.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"libdnet-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12-11.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"libdnet-progs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12-11.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"lshw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:B.02.16-4.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"lshw-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:B.02.16-4.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"lshw-gui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:B.02.16-4.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"netapp-manageability-sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0P1-3.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"netapp-manageability-sdk-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0P1-3.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"open-vm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.3-5.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"open-vm-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.3-5.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"open-vm-tools-desktop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.3-5.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"open-vm-tools-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.3-5.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"prince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0r2-4.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"pyliblzma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.3-7.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"pyliblzma-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.3-7.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"ruby200-rubygem-bcrypt-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-2.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"ruby200-rubygem-bcrypt-ruby-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-2.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"ruby200-rubygem-eventmachine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.7-2.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"ruby200-rubygem-eventmachine-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.7-2.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"ruby200-rubygem-ffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.8-1.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"ruby200-rubygem-ffi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.8-1.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"ruby200-rubygem-io-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.8-1.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"ruby200-rubygem-io-extra-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.8-1.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"ruby200-rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.2-2.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"ruby200-rubygem-json-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.2-2.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"ruby200-rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.11-2.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"ruby200-rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.11-2.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"ruby200-rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.2-9.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"ruby200-rubygem-pg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.2-9.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"ruby200-rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.13-1.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"ruby200-rubygem-psych-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.13-1.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"ruby200-rubygem-qpid_messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.20.2-5.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"ruby200-rubygem-qpid_messaging-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.20.2-5.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"ruby200-rubygem-therubyracer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.0-5.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"ruby200-rubygem-therubyracer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.0-5.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"ruby200-rubygem-thin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-9.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"ruby200-rubygem-thin-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-9.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"sneakernet_ca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1-2.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"wmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.14-1.el6cf"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"wmi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.14-1.el6cf"}]}],"bundled":5}],"products":[{"vendor":"sprockets_project","product":"sprockets"}],"references":[{"url":"http://lists.opensuse.org/opensuse-updates/2014-11/msg00105.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-11/msg00111.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article","web"]},{"url":"https://groups.google.com/forum/message/raw?msg=rubyonrails-security/doAVp0YaTqY/aHFngBqNBoAJ","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-11/msg00103.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-11/msg00110.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article","web"]},{"url":"https://groups.google.com/forum/message/raw?msg=rubyonrails-security/wQBeGXqGs3E/JqUMB6fhh3gJ","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7819","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHBA-2015:1100","tags":["web","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-7819","tags":["web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1161527","tags":["web","report"]},{"url":"https://groups.google.com/forum/#!topic/rubyonrails-security/doAVp0YaTqY","tags":["web","article"]},{"url":"https://github.com/advisories/GHSA-33pp-3763-mrfp"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-7819","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0074.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14664","tags":["report"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_CloudForms/3.2/html/Release_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1146178","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1160890","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1161248","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1161253","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1161322","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1161701","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1161744","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1163382","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1163465","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1163468","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1163469","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1163472","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1163661","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1163952","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1163978","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1164033","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1164386","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1164764","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1166187","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1166198","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1166303","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1166328","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1166861","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1167110","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1167308","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1167410","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1168337","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1168345","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1169351","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1169502","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1169930","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1169937","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1170319","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1170358","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1170813","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1171167","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1171286","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1171577","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1171589","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1171738","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1171780","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1172298","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1173213","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1173216","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1173251","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1173336","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1173712","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1174855","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1174881","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1176280","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1176619","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1176689","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1176721","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1177015","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1177809","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1178078","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1178697","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1178729","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1179503","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1179797","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1186502","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1186911","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1179807","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1179907","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1179908","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1179958","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1180313","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1180649","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1180746","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1181429","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1181768","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1182329","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1182330","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1182654","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1182795","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1183757","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1184250","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1184267","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1184343","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1184465","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1184575","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1184637","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1184990","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185042","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1186364","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1186413","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1186485","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1187233","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1187836","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1188401","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1188427","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1188436","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1188585","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1188597","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1188798","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1190054","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1190211","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1190260","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1190293","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1190564","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1190565","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1190584","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1190603","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1190667","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1190672","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1190852","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1190855","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1191197","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1191279","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1191468","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1191489","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1191496","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1191585","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1192039","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1192198","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1192223","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1192409","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1192518","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1192562","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1193183","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1193522","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1193615","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1193847","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1194223","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1194242","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1194319","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1194479","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1195407","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1198814","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1195754","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1195832","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1195877","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1196369","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1196384","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1196851","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1196852","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1197067","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1198111","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1198594","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1198735","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1198867","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1199240","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1199915","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1200424","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1200601","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1200757","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1200783","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1200854","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1200925","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1201092","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1201093","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1201097","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1201132","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1201137","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1201140","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1201378","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1201383","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1201531","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1201684","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1201716","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1201720","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1201751","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1201771","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1201883","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1201920","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1201932","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1202195","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1202216","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1202229","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1202394","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1202412","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1202415","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1202427","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1202465","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1202478","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1202491","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1202543","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1202648","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1202655","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1202660","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1202681","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1202816","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1203003","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1203168","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1203184","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1203207","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1203301","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1203426","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1203442","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1203547","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1203713","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1204115","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1204117","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1204125","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1204232","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1204252","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1204548","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1204599","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1204629","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1204635","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1204899","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1204912","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1204943","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1205137","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1205213","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1205235","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1205247","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1205347","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1205386","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1205407","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1205453","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1205496","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1205779","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1205898","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1205918","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1205919","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1205920","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1206016","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1206022","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1206023","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1206028","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1206122","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1206124","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1206141","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1206142","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1206204","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1206263","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1206662","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1206672","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1206675","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1206687","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1206727","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1206729","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1207018","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1207112","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1207209","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1207259","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1207298","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1207313","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1207631","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1207641","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1207788","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1207842","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1207859","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1207865","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1207895","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1208129","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1208152","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1208258","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1208642","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1208698","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1208852","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1209015","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1209262","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1209421","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1209557","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1209629","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1209641","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1209642","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1209711","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1209756","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1209847","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1209945","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1210089","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1210094","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1210277","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1210376","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1210385","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1210507","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1210761","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1211121","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1211125","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1211209","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1211241","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1211249","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1211306","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1211308","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1211364","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1211385","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1211392","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1212428","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1211409","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1211410","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1211489","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1211553","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1211592","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1211620","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1211652","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1211687","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1211693","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1212052","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1212123","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1212164","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1212382","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1212411","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1212423","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1212466","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1212534","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1212656","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1212687","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1212778","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1213014","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1213044","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1213145","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1213378","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1213533","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1213553","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1213570","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1213853","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1213863","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1213874","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1213939","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1214005","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1214012","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1214081","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1214204","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1214543","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1214680","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1214690","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1214725","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1214776","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1214833","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1214925","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1215216","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1215272","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1215285","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1215566","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1215615","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1215812","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1216005","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1216157","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1216209","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1216210","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1216222","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1216224","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1216969","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1216978","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1217161","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1217195","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1217216","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1217253","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1217257","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1217262","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1217324","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1217336","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1217348","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1217391","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1217394","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1217532","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1217597","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1217601","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1217637","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1217812","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1217818","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1218406","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1218429","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1218436","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1218441","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1218607","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1218786","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1218944","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1219019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1219098","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1219171","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1219329","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1219439","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1219614","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1219642","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1220383","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1220516","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1220882","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1220901","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1221299","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1221324","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1221366","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1221479","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1221510","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1221716","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1222035","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1222138","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1222615","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1222616","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1223042","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1223835","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1223934","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1225173","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1225178","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1225205","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1225377","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1225662","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1226428","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1227441","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1228407","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhba-2015_1100.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4389","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1013913","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4389","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4389","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4492","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1039435","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4492","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4492","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7819","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-1820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1205291","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1820","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1820","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-3448","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1240982","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3448","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3448","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150787-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/903658","tags":["report"]},{"url":"https://bugzilla.suse.com/926549","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7819","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150863-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/852794","tags":["report"]},{"url":"https://bugzilla.suse.com/876313","tags":["report"]},{"url":"https://bugzilla.suse.com/880078","tags":["report"]},{"url":"https://bugzilla.suse.com/887893","tags":["report"]},{"url":"https://bugzilla.suse.com/904372","tags":["report"]},{"url":"https://bugzilla.suse.com/904375","tags":["report"]},{"url":"https://bugzilla.suse.com/912512","tags":["report"]},{"url":"https://bugzilla.suse.com/914765","tags":["report"]},{"url":"https://bugzilla.suse.com/918203","tags":["report"]},{"url":"https://bugzilla.suse.com/918239","tags":["report"]},{"url":"https://bugzilla.suse.com/918395","tags":["report"]},{"url":"https://bugzilla.suse.com/919037","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7829","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-7819","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-7819","description":"Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.","status":"published","published":"2014-11-08T11:00:00Z","modified":"2024-08-06T13:03:27.17Z","updated_at":"2026-11-02T14:33:46.631905Z"}],"euvd":[{"id":"EUVD-2017-0153","description":"Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.","status":"published","published":"2014-11-08T11:00:00Z","modified":"2024-08-06T13:03:27Z","updated_at":"2026-11-03T01:56:53.380571Z"}],"ghsa":[{"id":"GHSA-33pp-3763-mrfp","title":"sprockets vulnerable to Path Traversal","description":"Multiple directory traversal vulnerabilities in `server.rb` in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.","status":"published","published":"2017-10-24T18:33:36Z","modified":"2023-03-01T18:54:56Z","cwes":["CWE-22"],"updated_at":"2026-11-02T14:36:46.526285Z"}],"nvd":[{"id":"CVE-2014-7819","description":"Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.","status":"published","published":"2014-11-08T11:55:03.023Z","modified":"2026-06-17T00:15:45.13Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:02:57.304171Z"}],"osv":[{"id":"CVE-2014-7819","description":"Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.","status":"published","published":"2014-11-08T11:55:03Z","modified":"2026-04-16T06:16:31.274803722Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-7819","description":"Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.","status":"published","published":"2014-11-08T11:55:03.023Z","modified":"2026-10-23T15:47:25.52371055Z","updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"GHSA-33pp-3763-mrfp","title":"sprockets vulnerable to Path Traversal","description":"Multiple directory traversal vulnerabilities in `server.rb` in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.","status":"published","published":"2017-10-24T18:33:36Z","modified":"2024-11-28T05:27:03.08176Z","cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:35.050232Z"},{"id":"MGASA-2015-0074","title":"Updated ruby-sprockets packages fix CVE-2014-7819","description":"Updated ruby-sprockets packages fix security vulnerabilities:\n\nMultiple directory traversal vulnerabilities in server.rb in Sprockets 2.12.x\nbefore 2.12.3, allow remote attackers to determine the existence of files\noutside the application root via a ../ (dot dot slash) sequence with double\nslashes or URL encoding (CVE-2014-7819).\n","status":"published","published":"2015-02-19T14:43:07Z","modified":"2026-04-16T06:24:39.394224725Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"RHBA-2015:1100","title":"Red Hat Bug Fix Advisory: CFME 5.4.0 bug fixes, and enhancement update","status":"published","published":"2024-09-15T22:03:52Z","modified":"2026-06-28T10:12:37Z","updated_at":"2026-11-02T15:52:58.117212Z"},{"id":"SUSE-SU-2015:0787-1","title":"Security update for rubygem-sprockets-2_11","description":"\nThis update for rubygem-sprockets-2_11 provides the following security fix:\n\n    * Arbitrary file existence disclosure (bnc#903658, CVE-2014-7819)\n\nSecurity Issues:\n\n    * CVE-2014-7819\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7819\u003e\n\n","status":"published","published":"2015-04-09T18:13:42Z","modified":"2026-02-04T03:45:47.887143Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0863-1","title":"Security update for SUSE Studio","description":"\nThis update provides SUSE Studio 1.3.10, including Amazon's EC2 support for \nSUSE Linux Enterprise 12 appliances.\n\nAdditionally, the update includes fixes for the following issues:\n\n    * #904372 - Arbitrary file existence disclosure in sprockets gem\n      (CVE-2014-7819)\n    * #904375 - Arbitrary file existence disclosure in Action Pack gem\n      (CVE-2014-7818)\n    * #918203 - Arbitrary file existence disclosure in Studio Onsite\n      (CVE-2014-7829)\n    * #852794 - SLES 11-SP3 templates fail to build x86_64 EC2 images\n    * #914765 - Change of appliance name is not displayed in appliance's\n      change log\n    * #887893 - Change log not accessible via API\n    * #918239 - Failure to create new appliances after upgrade to Studio\n      Onsite 1.3.9\n    * #918395 - Remove 32bit as target for building EC2 appliances\n    * #912512 - Studio doesn't allow duplicated repositories\n    * #880078 - Studio packages contain files that get modified (by Studio)\n      after installation.\n    * #919037 - Can't open appliance on Gallery: undefined\n      restructure_unsupportable_packages method.\n\nSecurity Issues:\n\n    * CVE-2014-7819\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7819\u003e\n    * CVE-2014-7818\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7818\u003e\n    * CVE-2014-7829\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7829\u003e\n\n","status":"published","published":"2015-05-05T23:49:58Z","modified":"2026-02-04T04:09:35.456396Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"UBUNTU-CVE-2014-7819","description":"Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.","status":"withdrawn","published":"2014-11-08T11:55:00Z","modified":"2025-07-16T06:46:56.571102Z","updated_at":"2026-11-02T15:54:09.378953Z"}]}}