Ubuntu releases security update for ruby-sprockets to address file access vulnerability

Canonical has issued a security advisory (USN-8990-1) regarding a vulnerability in the ruby-sprockets package, a Rack-based asset packaging system. The flaw involves the incorrect handling of specially crafted requests when the Sprockets server is deployed in a production environment.

This vulnerability affects users running Ubuntu 16.04 LTS. A remote attacker can exploit this issue to bypass directory restrictions and access sensitive files located outside of the intended application root directory. To mitigate the risk, users must update the ruby-sprockets package and restart any applications utilizing the library.

Vulnerability details and mitigation

• Defect Class: Path traversal/unintended file access via specially crafted network requests.
• Affected Component: ruby-sprockets, the Rack-based asset packaging system used in Ruby environments.
• CVE Identifier: CVE-2018-3760.
• Fixed Version: The issue is addressed in ruby-sprockets version 3.3.0-1ubuntu0.1~esm1 for Ubuntu 16.04 LTS.
• Remediation Requirement: A standard system update is required, followed by a manual restart of all applications using Sprockets to apply the changes.

Why it matters

This update is critical for administrators maintaining legacy Ubuntu 16.04 LTS systems that rely on Ruby-based web applications. Because the vulnerability allows remote file access, it poses a significant security risk to production web servers if the asset packaging system is not patched and the associated services are not restarted.