GHSA-qp49-3pvw-x4m5
sinatra does not validate expanded path matches
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2022-29970
- https://github.com/sinatra/sinatra/pull/1683
- https://github.com/sinatra/sinatra/pull/1683/commits/462c3ca1db53ed3cfc394cf5948e9c948ad1c10e
- https://github.com/skylightio/skylight-ruby/pull/294
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sinatra/CVE-2022-29970.yml
- https://github.com/sinatra/sinatra
- https://lists.debian.org/debian-lts-announce/2022/10/msg00034.html
- https://lists.debian.org/debian-lts-announce/2024/09/msg00020.html