Alerts This Week
Warning Icon 1 1,154
Alerts This Week
Warning Icon 1 1,154

Serious Remote Code Execution Flaws in Ruby Sinatra for Ubuntu 22.04

ubuntu
Calendar Grey July 22, 2025
Dist Ubuntu Esm H88
Upgraded Sinatra addresses significant vulnerabilities in Ubuntu impacting several editions; maintain system stability by applying this patch.
Several security issues were fixed in Sinatra.

Summary

Several security issues were fixed in Sinatra.

Software Description:

- ruby-sinatra: Ruby web-development dressed in a DSL

Details:

It was discovered that Sinatra incorrectly handled serving static files.

An attacker could possibly use this issue to perform local file inclusion,

obtaining sensitive information.

(CVE-2022-29970)

It was discovered that Sinatra incorrectly handled special characters in

the Content-Disposition HTTP header. An attacker could possibly use this

issue to perform a reflected file download attack, achieving remote code

execution. (CVE-2022-45442)

Topics%20covered

Topics Covered

security advisory critical remote code execution Ubuntu local file inclusion rubysinatra

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS
  ruby-sinatra                    2.0.8.1-2+deb11u1build0.22.04.1

Ubuntu 20.04 LTS
  ruby-sinatra                    2.0.8.1-1ubuntu0.1~esm2
                                  Available with Ubuntu Pro

Ubuntu 18.04 LTS
  ruby-sinatra                    1.4.8-1ubuntu0.1~esm2
                                  Available with Ubuntu Pro

Ubuntu 16.04 LTS
  ruby-sinatra                    1.4.7-3ubuntu0.1~esm2
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-7664-1

CVE-2022-29970, CVE-2022-45442

Severity
critical
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-7664-1

Topics%20covered

Topics Covered

security advisory critical remote code execution Ubuntu local file inclusion rubysinatra

Package Information

https://launchpad.net/ubuntu/+source/ruby-sinatra/2.0.8.1-2+deb11u1build0.22.04.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here