GitHub Advisoryadvisory · RubyGems
GHSA-qp49-3pvw-x4m5 sinatra does not validate expanded path matches
HIGH
Official page ↗
- Aliases
- CVE-2022-29970
- Ecosystem
- RubyGems
- Packages
- sinatra
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-22, CWE-426
- Reviewed
- 2022-05-03
Affected packages
• RubyGems sinatra: < 2.2.0 → fixed in 2.2.0
Description
Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.
Related
Alias · CVE (1)
- CVE-2022-29970 Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files. vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-29970 advisory
- https://github.com/sinatra/sinatra/pull/1683 web
- https://github.com/sinatra/sinatra/pull/1683/commits/462c3ca1db53ed3cfc394cf5948e9c948ad1c10e web
- https://github.com/skylightio/skylight-ruby/pull/294 web
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sinatra/CVE-2022-29970.yml web
- https://github.com/sinatra/sinatra web
- https://lists.debian.org/debian-lts-announce/2022/10/msg00034.html web
- https://lists.debian.org/debian-lts-announce/2024/09/msg00020.html web