Read the docs
TI-2022-12310 Aliases CVE-2022-29970GHSA-qp49-3pvw-x4m5

Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.

Priority LOW 37CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Code execution
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 10 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22, CWE-426 and the CVSS impact.

Summary

Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.

Why it matters now

EPSS 0.02137 82nd percentileScored 2026-11-07
Fix Partial sinatra (RubyGems): 2.2.0Red Hat: 6 advisoriesRed Hat: 10 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—sinatra (RubyGems)before 2.2.02.2.0Patch availableGHSA-qp49-3pvw-x4m5
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • sinatra (RubyGems) Vendor— Affected before 2.2.0 Fixed in 2.2.0 Patch available GHSA-qp49-3pvw-x4m5

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:sinatrarb:sinatra:*:*:*:*:*:*:*:*before 2.2.0VulnerableSinatrarb
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:sinatrarb:sinatra:*:*:*:*:*:*:*:* Versions before 2.2.0 Vulnerable ·Sinatrarb
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-qp49-3pvw-x4m5 sinatra (RubyGems) Fixed in 2.2.0 Advisory →

Red Hat 6 advisories

  • RHSA-2022:8506 Released 2022-11-16 · Red Hat rating Important
    Satellite 6.12 Release
    • Red Hat Satellite 6.12 for RHEL 8 candlepin-4.1.15-1.el8sat, candlepin-selinux-4.1.15-1.el8sat, foreman-3.3.0.17-1.el8sat +19
  • RHSA-2022:4661 Released 2022-05-18 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux HighAvailability (v. 8) pcs-0.10.12-6.el8_6.1, pcs-snmp-0.10.12-6.el8_6.1
    • Red Hat Enterprise Linux ResilientStorage (v. 8) pcs-0.10.12-6.el8_6.1, pcs-snmp-0.10.12-6.el8_6.1
  • RHSA-2022:4587 Released 2022-05-18 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability (v. 9) pcs-0.11.1-10.el9_0.1, pcs-snmp-0.11.1-10.el9_0.1
    • Red Hat Enterprise Linux Resilient Storage (v. 9) pcs-0.11.1-10.el9_0.1, pcs-snmp-0.11.1-10.el9_0.1
Show 3 more Red Hat advisories
  • RHSA-2022:2253 Released 2022-05-16 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability EUS (v. 8.2) pcs-0.10.4-6.el8_2.2, pcs-snmp-0.10.4-6.el8_2.2
    • Red Hat Enterprise Linux Resilient Storage EUS (v. 8.2) pcs-0.10.4-6.el8_2.2, pcs-snmp-0.10.4-6.el8_2.2
  • RHSA-2022:2256 Released 2022-05-16 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux HighAvailability EUS (v.8.4) pcs-0.10.8-1.el8_4.1, pcs-snmp-0.10.8-1.el8_4.1
    • Red Hat Enterprise Linux ResilientStorage EUS (v.8.4) pcs-0.10.8-1.el8_4.1, pcs-snmp-0.10.8-1.el8_4.1
  • RHSA-2022:2255 Released 2022-05-16 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability E4S (v. 8.1) pcs-0.10.2-4.el8_1.2, pcs-snmp-0.10.2-4.el8_1.2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Red Hat Storage 3AffectedNo fix yet
Red Hat Enterprise Linux High Availability (v. 9)Fixed RHSA-2022:4587
Red Hat Enterprise Linux High Availability E4S (v. 8.1)Fixed RHSA-2022:2255
Red Hat Enterprise Linux High Availability EUS (v. 8.2)Fixed RHSA-2022:2253
Red Hat Enterprise Linux HighAvailability (v. 8)Fixed RHSA-2022:4661
Red Hat Enterprise Linux HighAvailability EUS (v.8.4)Fixed RHSA-2022:2256
Red Hat Enterprise Linux Resilient Storage (v. 9)Fixed RHSA-2022:4587
Red Hat Enterprise Linux Resilient Storage EUS (v. 8.2)Fixed RHSA-2022:2253
Red Hat Enterprise Linux ResilientStorage (v. 8)Fixed RHSA-2022:4661
Red Hat Enterprise Linux ResilientStorage EUS (v.8.4)Fixed RHSA-2022:2256
Red Hat Satellite 6.12 for RHEL 8Fixed RHSA-2022:8506
Not affected: 1 product
  • Red Hat Satellite 6.12 for RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-29970
  2. 2026-10-03 Alias added: GHSA-qp49-3pvw-x4m5

References

Patch 1

Advisory 2

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences