A file traversal vulnerability was discovered in src:ruby-sinatra, a popular web server often used with Ruby on Rails. We now validate that any expanded paths match the allowed `public_dir` when serving static files. . - ----------------------------------------------------------------------- Debian LTS Advisory DLA-3166-1
Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files. (CVE-2022-29970) References: - https://bugs.mageia.org/show_bug.cgi?id=30542 . MGASA-2022-0280 - Updated ruby-sinatra packages fix security vulnerability Publication date: 13 Aug 2022 URL: https://advisories.mageia.org/MGASA-2022-0280.html Type: security Affected Mageia releases: 8 CVE: CVE-2022-29970 Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files. (CVE-2022-29970) References: - https://bugs.mageia.org/show_bug.cgi?id=30542 - https://lists.suse.com/pipermail/sle-security-updates/2022-June/011265.html - https://www.cve.org/CVERecord?id=CVE-2022-29970 SRPMS: - 8/core/ruby-sinatra-2.0.8.1-1.1.mga8 . Python-flask libraries upgraded to resolve image hosting bug in Mageia. Urgent vulnerability notice issued.. Ruby Sinatra,Mageia Security,Static File Validation,Sinatra Update,Mageia Advisory. . LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.