Description
Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby-sinatra | 2.2.2-1 | — |
| Debian 13 | ruby-sinatra | 2.2.2-1 | — |
| Debian 12 | ruby-sinatra | 2.2.2-1 | — |
| Debian 11 | ruby-sinatra | 2.0.8.1-2+deb11u1 | DLA-3877-1 |
| Debian 10 | ruby-sinatra | 2.0.5-4+deb10u1 | DLA-3166-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | ruby-sinatra | 2.0.8.1-2+deb11u1build0.22.04.1 | USN-7664-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | ruby-sinatra | 2.0.8.1-1ubuntu0.1~esm2 | USN-7664-1 |
| Ubuntu Pro 18.04 LTS | ruby-sinatra | 1.4.8-1ubuntu0.1~esm2 | USN-7664-1 |
| Ubuntu Pro 16.04 LTS | ruby-sinatra | 1.4.7-3ubuntu0.1~esm2 | USN-7664-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | pcs +1 | 0.11.1-10.el9_0.1 | RHSA-2022:4587 |
| RHEL 8 | pcs +1 | 0.10.12-6.el8_6.1 | RHSA-2022:4661 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | foreman +1 | 3.3.0.17-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite Capsule 6 | foreman +1 | 3.3.0.17-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite Capsule 6 | python-django +1 | 3.2.14-2.el8pc | RHSA-2022:8506 |
| Red Hat Satellite Capsule 6 | rubygem-nokogiri | 1.13.8-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite Capsule 6 | rubygem-sinatra | 1:2.2.0-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite 6 | candlepin +1 | 4.1.15-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite 6 | foreman +13 | 3.3.0.17-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite 6 | python-django +1 | 3.2.14-2.el8pc | RHSA-2022:8506 |
| Red Hat Satellite 6 | rubygem-git | 1.11.0-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite 6 | rubygem-nokogiri | 1.13.8-1.el8sat | RHSA-2022:8506 |
| Red Hat Satellite 6 | rubygem-rails-html-sanitizer | 1.4.3-2.el8sat | RHSA-2022:8506 |
| Red Hat Satellite 6 | rubygem-sinatra | 1:2.2.0-1.el8sat | RHSA-2022:8506 |
| RHEL 8.4 EUS | pcs +1 | 0.10.8-1.el8_4.1 | RHSA-2022:2256 |
| RHEL 8.2 EUS | pcs +1 | 0.10.4-6.el8_2.2 | RHSA-2022:2253 |
| RHEL 8.1 E4S | pcs +1 | 0.10.2-4.el8_1.2 | RHSA-2022:2255 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | pcs +1 | 0.11.1-10.el9 | ALSA-2022:4587 |
| AlmaLinux 8 | pcs +1 | 0.10.12-6.el8.alma | ALSA-2022:4661 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | libdb | 5.3.28-42.el8_4 | RLSA-2022:8506 |
| Rocky Linux 8 | pcs | 0.10.12-6.el8_6.1 | RLSA-2022:4661 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud Crowbar 9 | grafana | 6.7.4-3.26.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-barbican | 7.0.1~dev24-3.14.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-cinder | 13.0.10~dev24-3.34.2 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-heat-gbp | 14.0.1~dev4-3.9.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-horizon-plugin-gbp-ui | 14.0.1~dev3-3.9.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-ironic | 11.1.5~dev18-3.28.2 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-keystone | 14.2.1~dev9-3.28.2 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-neutron | 13.0.8~dev206-3.40.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-neutron-gbp | 14.0.1~dev33-3.31.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud Crowbar 9 | python-Pillow | 5.2.0-3.17.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud Crowbar 9 | python-XStatic-jquery-ui | 1.13.0.1-4.3.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud Crowbar 9 | python-lxml | 4.2.4-3.3.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud Crowbar 9 | release-notes-suse-openstack-cloud | 9.20220413-3.30.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud Crowbar 9 | rubygem-sinatra | 1.4.6-4.3.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud Crowbar 8 | rubygem-sinatra | 1.4.6-3.3.1 | SUSE-SU-2022:2046-1 |
| SUSE OpenStack Cloud 9 | ardana-barbican | 9.0+git.1644879908.8a641c1-3.13.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | grafana | 6.7.4-3.26.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | openstack-barbican | 7.0.1~dev24-3.14.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | openstack-cinder | 13.0.10~dev24-3.34.2 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | openstack-heat-gbp | 14.0.1~dev4-3.9.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | openstack-horizon-plugin-gbp-ui | 14.0.1~dev3-3.9.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | openstack-ironic | 11.1.5~dev18-3.28.2 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | openstack-keystone | 14.2.1~dev9-3.28.2 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | openstack-neutron | 13.0.8~dev206-3.40.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | openstack-neutron-gbp | 14.0.1~dev33-3.31.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | python-Pillow | 5.2.0-3.17.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | python-XStatic-jquery-ui | 1.13.0.1-4.3.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | python-lxml | 4.2.4-3.3.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | release-notes-suse-openstack-cloud | 9.20220413-3.30.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-barbican | 7.0.1~dev24-3.35.2 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-cinder | 13.0.10~dev24-3.38.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-designate | 7.0.2~dev2-3.35.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-glance | 17.0.1~dev30-3.33.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-heat | 11.0.4~dev4-3.35.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-horizon | 14.1.1~dev11-4.39.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-ironic | 11.1.5~dev18-4.33.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-keystone | 14.2.1~dev9-3.36.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-magnum | 7.2.1~dev1-4.35.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-manila | 7.4.2~dev60-3.41.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-monasca | 2.7.1~dev10-3.37.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-monasca-ceilometer | 1.8.2~dev3-3.35.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-neutron | 13.0.8~dev206-6.39.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-nova | 18.3.1~dev91-3.39.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-octavia | 3.2.3~dev7-4.35.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-sahara | 9.0.2~dev15-3.35.1 | SUSE-SU-2022:1729-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-swift | 2.19.2~dev48-2.30.1 | SUSE-SU-2022:1729-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | pcs +1 | 0.11.1-10.el9_0.1 | ELSA-2022-9513 |
| Oracle Linux 8 | pcs +1 | 0.10.12-6.0.1.el8_6.1 | ELSA-2022-9416 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | sinatra | < 2.2.0 | 2.2.0 | GHSA-qp49-3pvw-x4m5 |
Advisories 18
- ALSA-2022:4587 Important: pcs security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2022:4661 Important: pcs security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2022:8506 Red Hat Security Advisory: Satellite 6.12 Release Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:4661 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2022:4587 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2022:2256 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2022:2255 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2022:2253 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- USN-7664-1 ruby-sinatra vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- DLA-3877-1 ruby-sinatra - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3166-1 ruby-sinatra - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2022:4661 Important: pcs security update Rocky Linux Security Advisories · Feb 4, 2026
- RLSA-2022:8506 Important: Satellite 6.12 Release Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2022:1729-1 Security update for ardana-barbican, grafana, openstack-barbican, openstack-cinder, openstack-heat-gbp, openstack-horizon-plugin-gbp-ui, openstack-ironic, openstack-keystone, openstack-neutron-gbp, python-lxml, release-notes-suse-openstack-cloud SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:2046-1 Security update for rubygem-sinatra SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-0267 Red Hat Enterprise Linux (pcs): Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Jul 22, 2025
- ELSA-2022-9513 Important: pcs security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 30, 2022
- ELSA-2022-9416 Important: pcs security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 20, 2022