-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   Red Hat Security Advisory

Synopsis:          Important: rh-ror50-rubygem-sprockets security update
Advisory ID:       RHSA-2018:2245-01
Product:           Red Hat Software Collections
Advisory URL:      https://access.redhat.com/errata/RHSA-2018:2245
Issue date:        2018-07-24
CVE Names:         CVE-2018-3760 
====================================================================
1. Summary:

An update for rh-ror50-rubygem-sprockets is now available for Red Hat
Software Collections.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - noarch
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - noarch
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) - noarch
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) - noarch
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) - noarch
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - noarch
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch

3. Description:

Sprockets is a Ruby library for compiling and serving web assets. It
features declarative dependency management for JavaScript and CSS assets,
as well as a powerful preprocessor pipeline that allows to write assets in
languages like CoffeeScript, Sass and SCSS.

Security Fix(es):

* rubygem-sprockets: Path traversal in forbidden_request?() can allow
remote attackers to read arbitrary files (CVE-2018-3760)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1593058 - CVE-2018-3760 rubygem-sprockets: Path traversal in forbidden_request?() can allow remote attackers to read arbitrary files

6. Package List:

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6):

Source:
rh-ror50-rubygem-sprockets-3.7.1-2.el6.src.rpm

noarch:
rh-ror50-rubygem-sprockets-3.7.1-2.el6.noarch.rpm
rh-ror50-rubygem-sprockets-doc-3.7.1-2.el6.noarch.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7):

Source:
rh-ror50-rubygem-sprockets-3.7.1-2.el6.src.rpm

noarch:
rh-ror50-rubygem-sprockets-3.7.1-2.el6.noarch.rpm
rh-ror50-rubygem-sprockets-doc-3.7.1-2.el6.noarch.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6):

Source:
rh-ror50-rubygem-sprockets-3.7.1-2.el6.src.rpm

noarch:
rh-ror50-rubygem-sprockets-3.7.1-2.el6.noarch.rpm
rh-ror50-rubygem-sprockets-doc-3.7.1-2.el6.noarch.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):

Source:
rh-ror50-rubygem-sprockets-3.7.1-2.el7.src.rpm

noarch:
rh-ror50-rubygem-sprockets-3.7.1-2.el7.noarch.rpm
rh-ror50-rubygem-sprockets-doc-3.7.1-2.el7.noarch.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3):

Source:
rh-ror50-rubygem-sprockets-3.7.1-2.el7.src.rpm

noarch:
rh-ror50-rubygem-sprockets-3.7.1-2.el7.noarch.rpm
rh-ror50-rubygem-sprockets-doc-3.7.1-2.el7.noarch.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4):

Source:
rh-ror50-rubygem-sprockets-3.7.1-2.el7.src.rpm

noarch:
rh-ror50-rubygem-sprockets-3.7.1-2.el7.noarch.rpm
rh-ror50-rubygem-sprockets-doc-3.7.1-2.el7.noarch.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5):

Source:
rh-ror50-rubygem-sprockets-3.7.1-2.el7.src.rpm

noarch:
rh-ror50-rubygem-sprockets-3.7.1-2.el7.noarch.rpm
rh-ror50-rubygem-sprockets-doc-3.7.1-2.el7.noarch.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):

Source:
rh-ror50-rubygem-sprockets-3.7.1-2.el7.src.rpm

noarch:
rh-ror50-rubygem-sprockets-3.7.1-2.el7.noarch.rpm
rh-ror50-rubygem-sprockets-doc-3.7.1-2.el7.noarch.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2018-3760
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBW1bZQdzjgjWX9erEAQhMCA/+NZjW/XjoRjygeCpnHCeujS169BOlQHez
i9DU4UEU9I3H/mbOiNpRB774RRhco8jUviPW909KFvCa7EBovCjQCnM2xDPP4Z8d
NpJ8oJyXvDS6QfLsZDCv4R/pQvzDRjxZBG0lqwf5fbzpOE3S91L4NLDd96jSWAww
NQycq5ggVt8PlVxmsvvfDe7I5Hh6SJAk0Cy/GLrNfBuqrRWwxWDyOWZDPFKzcIMq
ubR+QKq1erK0s6Q6Op+EWZJ/8bAElWUUI46Og17/PrNrpg9ifePFvifANFVZatD1
MM/hOWLTnt+hKidoFuqJO44VY4q+GQJhuHdyddlOUPIVReQd2EP8Y+bFCQ5gn9tQ
hykABZzTr31RZeZ7AkRmWm7v360A6vR0fYULxl6JdiM8p9wggxm2ngpIgwdtD6x1
7cH6Z5uuXBJu6GzALE9KXuffM5AbOKFfLAkVlLU5c5xIP4jbOwEeR1FUn8RctvYN
7Y9ScTrDY12JcAhfqMO7B3ndmF6yxKO6q0mJoLsRJAYPbf1yQPMfh2lKDpt15LAx
8D94xsVpu1mzPbk6Uv2z5Hx7yI7Pg2O2XKJ10HIQlOb7twCKRbijZRxLEXJ0q/G6
y2/+aJoGi0wG2PnVVAvMjJzWz/pe5ICKdIU2i2W6hW2jIAIMuYjAmMhlM65xw3C/
BB0LpHMaYQM=y6ry
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2018-2245:01 Important: rh-ror50-rubygem-sprockets security

An update for rh-ror50-rubygem-sprockets is now available for Red Hat Software Collections

Summary

Sprockets is a Ruby library for compiling and serving web assets. It features declarative dependency management for JavaScript and CSS assets, as well as a powerful preprocessor pipeline that allows to write assets in languages like CoffeeScript, Sass and SCSS.
Security Fix(es):
* rubygem-sprockets: Path traversal in forbidden_request?() can allow remote attackers to read arbitrary files (CVE-2018-3760)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.



Summary


Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2018-3760 https://access.redhat.com/security/updates/classification/#important

Package List

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6):
Source: rh-ror50-rubygem-sprockets-3.7.1-2.el6.src.rpm
noarch: rh-ror50-rubygem-sprockets-3.7.1-2.el6.noarch.rpm rh-ror50-rubygem-sprockets-doc-3.7.1-2.el6.noarch.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7):
Source: rh-ror50-rubygem-sprockets-3.7.1-2.el6.src.rpm
noarch: rh-ror50-rubygem-sprockets-3.7.1-2.el6.noarch.rpm rh-ror50-rubygem-sprockets-doc-3.7.1-2.el6.noarch.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6):
Source: rh-ror50-rubygem-sprockets-3.7.1-2.el6.src.rpm
noarch: rh-ror50-rubygem-sprockets-3.7.1-2.el6.noarch.rpm rh-ror50-rubygem-sprockets-doc-3.7.1-2.el6.noarch.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):
Source: rh-ror50-rubygem-sprockets-3.7.1-2.el7.src.rpm
noarch: rh-ror50-rubygem-sprockets-3.7.1-2.el7.noarch.rpm rh-ror50-rubygem-sprockets-doc-3.7.1-2.el7.noarch.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3):
Source: rh-ror50-rubygem-sprockets-3.7.1-2.el7.src.rpm
noarch: rh-ror50-rubygem-sprockets-3.7.1-2.el7.noarch.rpm rh-ror50-rubygem-sprockets-doc-3.7.1-2.el7.noarch.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4):
Source: rh-ror50-rubygem-sprockets-3.7.1-2.el7.src.rpm
noarch: rh-ror50-rubygem-sprockets-3.7.1-2.el7.noarch.rpm rh-ror50-rubygem-sprockets-doc-3.7.1-2.el7.noarch.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5):
Source: rh-ror50-rubygem-sprockets-3.7.1-2.el7.src.rpm
noarch: rh-ror50-rubygem-sprockets-3.7.1-2.el7.noarch.rpm rh-ror50-rubygem-sprockets-doc-3.7.1-2.el7.noarch.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):
Source: rh-ror50-rubygem-sprockets-3.7.1-2.el7.src.rpm
noarch: rh-ror50-rubygem-sprockets-3.7.1-2.el7.noarch.rpm rh-ror50-rubygem-sprockets-doc-3.7.1-2.el7.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/


Severity
Advisory ID: RHSA-2018:2245-01
Product: Red Hat Software Collections
Advisory URL: https://access.redhat.com/errata/RHSA-2018:2245
Issued Date: : 2018-07-24
CVE Names: CVE-2018-3760

Topic

An update for rh-ror50-rubygem-sprockets is now available for Red HatSoftware Collections.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.


Topic


 

Relevant Releases Architectures

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - noarch

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch

Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - noarch

Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) - noarch

Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) - noarch

Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) - noarch

Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - noarch

Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch


Bugs Fixed

1593058 - CVE-2018-3760 rubygem-sprockets: Path traversal in forbidden_request?() can allow remote attackers to read arbitrary files


Related News