CVE-2022-29970 sinatra does not validate expanded path matches
Attackers can read arbitrary files outside the public directory by exploiting path traversal in Sinatra's static file serving.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-29970?
CVE-2022-29970 is a high-severity path traversal vulnerability in Debian Debian Linux, published on 2 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.
Weakness: CWE-22
Which versions are affected by CVE-2022-29970?
2 open source packages ship an affected version, including sinatra. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
sinatra RubyGems | All versions | 2.2.0 |
sinatra RubyGems | All versions | 2.2.0 |
Linux distribution packages (24)
pcs AlmaLinux:8 | All versions | 0.10.12-6.el8.alma |
pcs-snmp AlmaLinux:8 | All versions | 0.10.12-6.el8.alma |
pcs AlmaLinux:9 | All versions | 0.11.1-10.el9 |
pcs-snmp AlmaLinux:9 | All versions | 0.11.1-10.el9 |
pcs Red Hat:enterprise_linux:8::highavailability | All versions | 0:0.10.12-6.el8_6.1 |
pcs-snmp Red Hat:enterprise_linux:8::highavailability | All versions | 0:0.10.12-6.el8_6.1 |
pcs Red Hat:enterprise_linux:8::resilientstorage | All versions | 0:0.10.12-6.el8_6.1 |
pcs-snmp Red Hat:enterprise_linux:8::resilientstorage | All versions | 0:0.10.12-6.el8_6.1 |
pcs Red Hat:enterprise_linux:9::highavailability | All versions | 0:0.11.1-10.el9_0.1 |
pcs-snmp Red Hat:enterprise_linux:9::highavailability | All versions | 0:0.11.1-10.el9_0.1 |
pcs Red Hat:enterprise_linux:9::resilientstorage | All versions | 0:0.11.1-10.el9_0.1 |
pcs-snmp Red Hat:enterprise_linux:9::resilientstorage | All versions | 0:0.11.1-10.el9_0.1 |
pcs Red Hat:rhel_e4s:8.1::highavailability | All versions | 0:0.10.2-4.el8_1.2 |
pcs-snmp Red Hat:rhel_e4s:8.1::highavailability | All versions | 0:0.10.2-4.el8_1.2 |
pcs Red Hat:rhel_eus:8.2::highavailability | All versions | 0:0.10.4-6.el8_2.2 |
pcs-snmp Red Hat:rhel_eus:8.2::highavailability | All versions | 0:0.10.4-6.el8_2.2 |
pcs Red Hat:rhel_eus:8.2::resilientstorage | All versions | 0:0.10.4-6.el8_2.2 |
pcs-snmp Red Hat:rhel_eus:8.2::resilientstorage | All versions | 0:0.10.4-6.el8_2.2 |
pcs Red Hat:rhel_eus:8.4::highavailability | All versions | 0:0.10.8-1.el8_4.1 |
pcs-snmp Red Hat:rhel_eus:8.4::highavailability | All versions | 0:0.10.8-1.el8_4.1 |
pcs Red Hat:rhel_eus:8.4::resilientstorage | All versions | 0:0.10.8-1.el8_4.1 |
pcs-snmp Red Hat:rhel_eus:8.4::resilientstorage | All versions | 0:0.10.8-1.el8_4.1 |
pcs Rocky Linux:8 | All versions | 0:0.10.12-6.el8_6.1 |
rubygem-sinatra SUSE:OpenStack Cloud Crowbar 8 | All versions | 1.4.6-3.3.1 |
Products include Debian Debian Linux, Sinatrarb Sinatra.
How do I fix CVE-2022-29970?
Upgrade sinatra to 2.2.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-29970 being exploited?
There is no known exploitation of CVE-2022-29970 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALSA-2022:4587, ALSA-2022:4661, DEBIAN-CVE-2022-29970, DLA-3166-1, GHSA-qp49-3pvw-x4m5, MGASA-2022-0280 and 8 more.