Path traversal in Sinatra - CVE-2022-29970

Vulnerability identifier: #VU63415

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-29970

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.

Sinatra
IBM Watson Machine Learning Accelerator
Red Hat Satellite
SUSE OpenStack Cloud Crowbar
Ubuntu
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
pcs (Red Hat package)
ruby2.1-rubygem-sinatra
ruby-sinatra (Ubuntu package)

Install update from vendor's website.

Sinatra - update to 2.2.0
pcs (Red Hat package) - addressed in versions 0.10.2-4.el8_1.2, 0.10.4-6.el8_2.2, 0.10.8-1.el8_4.1, 0.10.12-6.el8_6.1, 0.11.1-10.el9_0.1
ruby2.1-rubygem-sinatra - update to 1.4.6-3.3.1
ruby-sinatra (Ubuntu package) - addressed in versions 1.4.7-3ubuntu0.1~esm2, 1.4.8-1ubuntu0.1~esm2, 2.0.8.1-1ubuntu0.1~esm2, 2.0.8.1-2+deb11u1build0.22.04.1

• https://github.com/sinatra/sinatra/pull/1683/commits/462c3ca1db53ed3cfc394cf5948e9c948ad1c10e

• Path traversal in Sinatra
• Red Hat Enterprise Linux Update Services for SAP Solutions 8.1 update for pcs
• SUSE update for rubygem-sinatra
• Multiple vulnerabilities in Red Hat Satellite 6.12
• Red Hat Enterprise Linux 8.2 Extended Update Support update for pcs
• Red Hat Enterprise Linux 8.4 Extended Update Support update for pcs
• Red Hat Enterprise Linux 8 update for pcs
• Red Hat Enterprise Linux 9 update for pcs
• Multiple vulnerabilities in Watson Machine Learning Accelerator on Cloud Pak for Data
• Ubuntu update for ruby-sinatra