On this page (8 sections)
Ubuntu has published USN-8990-1, a security notice for the ruby-sprockets package. The notice says Sprockets incorrectly handled certain specially crafted requests when the Sprockets server was used in production, and that a remote attacker could possibly use this to access files outside the application's root directory.
If you run a Ruby or Rails application on Ubuntu 16.04 LTS, or manage servers that do, this is worth a few minutes. Ubuntu's fix is a standard package update followed by an application restart.
What the notice says
According to the Ubuntu notice, the problem lies in how Sprockets handles specially crafted requests when the Sprockets server is used in production. The impact described is unintended access to files over the network: a remote attacker could possibly reach files outside the application's root directory.
The notice references a single identifier, CVE-2018-3760. It does not give a severity rating or CVSS score, and it does not say whether the issue is being exploited. Only one publisher, Ubuntu itself, is the source for this story so far, so treat anything beyond those points as unconfirmed.
The weakness in plain terms
The notice does not name the weakness class. Our own reading is that the described behavior is consistent with a path traversal (directory traversal) problem: an application is meant to serve files only from a defined folder, and a crafted request manages to reach files outside it. That is our interpretation, not wording from Ubuntu.
The notice does not say which files could be reached, and we do not speculate on that. As a general principle, files readable by the user account running the application are the ones most at risk from any flaw of this kind.
Who is realistically exposed
- Servers running Ubuntu 16.04 LTS with the ruby-sprockets package from the distribution, which is the only release the notice lists.
- Applications that use the Sprockets server in production. The notice ties the issue to that usage.
Other Ubuntu releases are not listed in this notice. If you install Sprockets through Bundler as a gem rather than through the Ubuntu package, the Ubuntu update will not change your application's bundled copy, because the notice covers only the distribution package. Check your own Gemfile.lock and your framework's guidance.
How to check your exposure
This read-only command shows whether the ruby-sprockets package is installed and which version you have. Run it on the server. On 16.04, a version older than 3.3.0-1ubuntu0.1~esm1 means the fix is not yet applied.
dpkg -l ruby-sprocketsThis read-only command shows the installed version and the candidate version from your configured package sources, which tells you whether the fixed build is available to this machine.
apt-cache policy ruby-sprocketsWhat to do now
Ubuntu's instructions are to perform a standard system update and then restart any applications that use Sprockets so the necessary changes take effect. This command refreshes the package index and upgrades only ruby-sprockets. Run it on each affected server, then confirm the new version.
sudo apt-get update
sudo apt-get install --only-upgrade ruby-sprockets0 of 6 done
Monitoring afterwards
The notice provides no indicators of exploitation and no known attack request patterns, so there is no log signature we can point to for this issue. As optional general hygiene, you can scan a web server access log for requests containing parent-directory sequences. This standard grep does that for an Nginx log. Adjust the path for your server and review any hits manually. A match is not evidence of an attack on this flaw, and no match does not prove safety.
grep -E '\.\./|%2e%2e' /var/log/nginx/access.logIf you have reason to believe your server was compromised, our guide on what to do if your website is hacked walks through the steps.
For ongoing visibility, a read-only scan of sites you own can show what is publicly reachable, and monitoring can alert you to unexpected changes in headers or certificates. Neither replaces patching the underlying package.
Why an old CVE appears in a new notice
The referenced identifier, CVE-2018-3760, carries a 2018 year, while the Ubuntu notice is dated 3 November 2026. The notice does not explain the gap. It gives the fixed version with an esm1 suffix and does not say why the fix was released now.
Timeline
| Date | Event |
|---|---|
| 3 November 2026 | Ubuntu publishes USN-8990-1 with ruby-sprockets 3.3.0-1ubuntu0.1~esm1 for 16.04 LTS |
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.