CVE-2022-29970
Fixed in a distro release EPSS 2%
Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.
Products: sinatrarb sinatra, debian_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | sinatra | 2.2.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | pcs | 0.10.12-6.el8.alma |
| AlmaLinux 8 | pcs-snmp | 0.10.12-6.el8.alma |
| AlmaLinux 9 | pcs | 0.11.1-10.el9 |
| AlmaLinux 9 | pcs-snmp | 0.11.1-10.el9 |
| Debian 10 | ruby-sinatra | 2.0.5-4+deb10u1 |
| Debian 11 | ruby-sinatra | 2.0.8.1-2+deb11u1 |
| Debian 12 | ruby-sinatra | 2.2.2-1 |
| Debian 13 | ruby-sinatra | 2.2.2-1 |
| Debian 14 | ruby-sinatra | 2.2.2-1 |
| Red Hat Enterprise Linux 8 | pcs | 0:0.10.12-6.el8_6.1 |
| Red Hat Enterprise Linux 8 | pcs-snmp | 0:0.10.12-6.el8_6.1 |
| Red Hat Enterprise Linux 9 | pcs | 0:0.11.1-10.el9_0.1 |
| Red Hat Enterprise Linux 9 | pcs-snmp | 0:0.11.1-10.el9_0.1 |
| Red Hat rhel e4s 8.1 | pcs | 0:0.10.2-4.el8_1.2 |
| Red Hat rhel e4s 8.1 | pcs-snmp | 0:0.10.2-4.el8_1.2 |
| Red Hat rhel eus 8.2 | pcs | 0:0.10.4-6.el8_2.2 |
| Red Hat rhel eus 8.2 | pcs-snmp | 0:0.10.4-6.el8_2.2 |
| Red Hat rhel eus 8.4 | pcs | 0:0.10.8-1.el8_4.1 |
| Red Hat rhel eus 8.4 | pcs-snmp | 0:0.10.8-1.el8_4.1 |
| Red Hat satellite 6.12 | candlepin | 0:4.1.15-1.el8sat |
| Red Hat satellite 6.12 | candlepin-selinux | 0:4.1.15-1.el8sat |
| Red Hat satellite 6.12 | foreman | 0:3.3.0.17-1.el8sat |
| Red Hat satellite 6.12 | foreman-cli | 0:3.3.0.17-1.el8sat |
| Red Hat satellite 6.12 | foreman-debug | 0:3.3.0.17-1.el8sat |
| Red Hat satellite 6.12 | foreman-dynflow-sidekiq | 0:3.3.0.17-1.el8sat |
| Red Hat satellite 6.12 | foreman-ec2 | 0:3.3.0.17-1.el8sat |
| Red Hat satellite 6.12 | foreman-gce | 0:3.3.0.17-1.el8sat |
| Red Hat satellite 6.12 | foreman-journald | 0:3.3.0.17-1.el8sat |
| Red Hat satellite 6.12 | foreman-libvirt | 0:3.3.0.17-1.el8sat |
| Red Hat satellite 6.12 | foreman-openstack | 0:3.3.0.17-1.el8sat |
| Red Hat satellite 6.12 | foreman-ovirt | 0:3.3.0.17-1.el8sat |
| Red Hat satellite 6.12 | foreman-postgresql | 0:3.3.0.17-1.el8sat |
| Red Hat satellite 6.12 | foreman-service | 0:3.3.0.17-1.el8sat |
| Red Hat satellite 6.12 | foreman-telemetry | 0:3.3.0.17-1.el8sat |
| Red Hat satellite 6.12 | foreman-vmware | 0:3.3.0.17-1.el8sat |
| Red Hat satellite 6.12 | python-django | 0:3.2.14-2.el8pc |
| Red Hat satellite 6.12 | python39-django | 0:3.2.14-2.el8pc |
| Red Hat satellite 6.12 | rubygem-git | 0:1.11.0-1.el8sat |
| Red Hat satellite 6.12 | rubygem-nokogiri | 0:1.13.8-1.el8sat |
| Red Hat satellite 6.12 | rubygem-nokogiri-debuginfo | 0:1.13.8-1.el8sat |
| Red Hat satellite 6.12 | rubygem-nokogiri-debugsource | 0:1.13.8-1.el8sat |
| Red Hat satellite 6.12 | rubygem-rails-html-sanitizer | 0:1.4.3-2.el8sat |
| Red Hat satellite 6.12 | rubygem-sinatra | 1:2.2.0-1.el8sat |
| Red Hat satellite capsule 6.12 | foreman | 0:3.3.0.17-1.el8sat |
| Red Hat satellite capsule 6.12 | foreman-debug | 0:3.3.0.17-1.el8sat |
| Red Hat satellite capsule 6.12 | python-django | 0:3.2.14-2.el8pc |
| Red Hat satellite capsule 6.12 | python39-django | 0:3.2.14-2.el8pc |
| Red Hat satellite capsule 6.12 | rubygem-nokogiri | 0:1.13.8-1.el8sat |
| Red Hat satellite capsule 6.12 | rubygem-nokogiri-debuginfo | 0:1.13.8-1.el8sat |
| Red Hat satellite capsule 6.12 | rubygem-nokogiri-debugsource | 0:1.13.8-1.el8sat |
| Red Hat satellite capsule 6.12 | rubygem-sinatra | 1:2.2.0-1.el8sat |
| Red Hat satellite utils 6.12 | foreman | 0:3.3.0.17-1.el8sat |
| Red Hat satellite utils 6.12 | foreman-cli | 0:3.3.0.17-1.el8sat |
| Rocky Linux 8 | libdb | 0:5.3.28-42.el8_4 |
| Rocky Linux 8 | pcs | 0:0.10.12-6.el8_6.1 |
| SUSE OpenStack Cloud 9 | ardana-barbican | 9.0+git.1644879908.8a641c1-3.13.1 |
| SUSE OpenStack Cloud 9 | grafana | 6.7.4-3.26.1 |
| SUSE OpenStack Cloud 9 | openstack-barbican | 7.0.1~dev24-3.14.1 |
| SUSE OpenStack Cloud 9 | openstack-cinder | 13.0.10~dev24-3.34.2 |
| SUSE OpenStack Cloud 9 | openstack-heat-gbp | 14.0.1~dev4-3.9.1 |
| SUSE OpenStack Cloud 9 | openstack-horizon-plugin-gbp-ui | 14.0.1~dev3-3.9.1 |
| SUSE OpenStack Cloud 9 | openstack-ironic | 11.1.5~dev18-3.28.2 |
| SUSE OpenStack Cloud 9 | openstack-keystone | 14.2.1~dev9-3.28.2 |
| SUSE OpenStack Cloud 9 | openstack-neutron | 13.0.8~dev206-3.40.1 |
| SUSE OpenStack Cloud 9 | openstack-neutron-gbp | 14.0.1~dev33-3.31.1 |
| SUSE OpenStack Cloud 9 | python-Pillow | 5.2.0-3.17.1 |
| SUSE OpenStack Cloud 9 | python-XStatic-jquery-ui | 1.13.0.1-4.3.1 |
| SUSE OpenStack Cloud 9 | python-lxml | 4.2.4-3.3.1 |
| SUSE OpenStack Cloud 9 | release-notes-suse-openstack-cloud | 9.20220413-3.30.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-barbican | 7.0.1~dev24-3.35.2 |
| SUSE OpenStack Cloud 9 | venv-openstack-cinder | 13.0.10~dev24-3.38.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-designate | 7.0.2~dev2-3.35.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-glance | 17.0.1~dev30-3.33.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-heat | 11.0.4~dev4-3.35.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-horizon | 14.1.1~dev11-4.39.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-ironic | 11.1.5~dev18-4.33.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-keystone | 14.2.1~dev9-3.36.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-magnum | 7.2.1~dev1-4.35.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-manila | 7.4.2~dev60-3.41.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-monasca | 2.7.1~dev10-3.37.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-monasca-ceilometer | 1.8.2~dev3-3.35.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-neutron | 13.0.8~dev206-6.39.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-nova | 18.3.1~dev91-3.39.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-octavia | 3.2.3~dev7-4.35.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-sahara | 9.0.2~dev15-3.35.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-swift | 2.19.2~dev48-2.30.1 |
| SUSE OpenStack Cloud Crowbar 8 | rubygem-sinatra | 1.4.6-3.3.1 |
| SUSE OpenStack Cloud Crowbar 9 | grafana | 6.7.4-3.26.1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-barbican | 7.0.1~dev24-3.14.1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-cinder | 13.0.10~dev24-3.34.2 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-heat-gbp | 14.0.1~dev4-3.9.1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-horizon-plugin-gbp-ui | 14.0.1~dev3-3.9.1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-ironic | 11.1.5~dev18-3.28.2 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-keystone | 14.2.1~dev9-3.28.2 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-neutron | 13.0.8~dev206-3.40.1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-neutron-gbp | 14.0.1~dev33-3.31.1 |
| SUSE OpenStack Cloud Crowbar 9 | python-Pillow | 5.2.0-3.17.1 |
| SUSE OpenStack Cloud Crowbar 9 | python-XStatic-jquery-ui | 1.13.0.1-4.3.1 |
| SUSE OpenStack Cloud Crowbar 9 | python-lxml | 4.2.4-3.3.1 |
| SUSE OpenStack Cloud Crowbar 9 | release-notes-suse-openstack-cloud | 9.20220413-3.30.1 |
| SUSE OpenStack Cloud Crowbar 9 | rubygem-sinatra | 1.4.6-4.3.1 |
| Ubuntu 22.04 LTS | ruby-sinatra | 2.0.8.1-2+deb11u1build0.22.04.1 |
| Ubuntu Pro 16.04 LTS | ruby-sinatra | 1.4.7-3ubuntu0.1~esm2 |
| Ubuntu Pro 18.04 LTS | ruby-sinatra | 1.4.8-1ubuntu0.1~esm2 |
| Ubuntu Pro 20.04 LTS | ruby-sinatra | 2.0.8.1-1ubuntu0.1~esm2 |