842225 – (CVE-2022-29970) <dev-ruby/sinatra-2.2.0: lacking validation for public_dir expanded path matches

Bug 842225 (CVE-2022-29970) - <dev-ruby/sinatra-2.2.0: lacking validation for public_dir expanded path matches

Summary: <dev-ruby/sinatra-2.2.0: lacking validation for public_dir expanded path matches

Status:	RESOLVED FIXED

Alias:	CVE-2022-29970

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor
Assignee:	Gentoo Security

URL:	https://github.com/sinatra/sinatra/pu...
Whiteboard:	B4 [noglsa]
Keywords:

Depends on:
Blocks:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description John Helmert III archtester

2022-05-02 19:47:09 UTC

CVE-2022-29970:

Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.

Comment 1 Hans de Graaff gentoo-dev

2022-05-06 08:22:58 UTC

Sinatry 2.2.0 is in the tree and stable. Cleanup done.

Comment 2 John Helmert III archtester

2022-05-10 15:53:23 UTC

Thanks! Impact seems limited so no GLSA, unless there's any objection.