RubyGems Sprockets CVE-2014-7819 Information Disclosure Vulnerability

Bugtraq ID:	70858
Class:	Design Error
CVE:	CVE-2014-7819
Remote:	Yes
Local:	No
Published:	Oct 30 2014 12:00AM
Updated:	Oct 30 2014 12:00AM
Credit:	Dennis Hackethal and Christian Hansen of Crowdcurity, Juan C. Müller and Mike McClurg of Greenhouse.io , and Alex Ianus of Coinbase
Vulnerable:	Joshua Peek Sprockets 2.12.2 Joshua Peek Sprockets 2.12 Joshua Peek Sprockets 2.11.2 Joshua Peek Sprockets 2.11 Joshua Peek Sprockets 2.10.1 Joshua Peek Sprockets 2.10 Joshua Peek Sprockets 2.8.2 Joshua Peek Sprockets 2.8 Joshua Peek Sprockets 2.7 Joshua Peek Sprockets 2.5 Joshua Peek Sprockets 2.4.5 Joshua Peek Sprockets 2.4 Joshua Peek Sprockets 2.3.2 Joshua Peek Sprockets 2.3 Joshua Peek Sprockets 2.2.2 Joshua Peek Sprockets 2.2 Joshua Peek Sprockets 2.1.3 Joshua Peek Sprockets 2.1 Joshua Peek Sprockets 2.0.4 Joshua Peek Sprockets 2.0
Not Vulnerable:	Joshua Peek Sprockets 3.0 beta.3 Joshua Peek Sprockets 2.12.3 Joshua Peek Sprockets 2.11.3 Joshua Peek Sprockets 2.10.2 Joshua Peek Sprockets 2.9.4 Joshua Peek Sprockets 2.8.3 Joshua Peek Sprockets 2.7.1 Joshua Peek Sprockets 2.5.1 Joshua Peek Sprockets 2.4.6 Joshua Peek Sprockets 2.3.3 Joshua Peek Sprockets 2.2.3 Joshua Peek Sprockets 2.1.4 Joshua Peek Sprockets 2.0.5

RubyGems Sprockets CVE-2014-7819 Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

RubyGems Sprockets CVE-2014-7819 Information Disclosure Vulnerability

References:

• Sprockets Homepage (RubyGems)
  
• CVE-2014-7819 Arbitrary file existence disclosure in Sprockets (Seclist.org)