Most recent entries from all

ALSA-2023:0855 — Moderate: pcs security update

Affected: AlmaLinux:8: pcs, AlmaLinux:8: pcs-snmp

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

* sinatra: Reflected File Download attack (CVE-2022-45442)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-01888

EUVD-2026-258814

fkie_cve-2022-45442

Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.

GHSA-2x8x-jmrp-phxw — Sinatra vulnerable to Reflected File Download attack

Affected: RubyGems: sinatra

### Description An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input.

### References * https://www.blackhat.com/docs/eu-14/materials/eu-14-Hafif-Reflected-File-Download-A-New-Web-Attack-Vector.pdf * https://github.com/advisories/GHSA-8x94-hmjh-97hq

gsd-2022-45442

OESA-2024-2474 — rubygem-sinatra security update

Affected: openEuler:22.03-LTS-SP1: rubygem-sinatra

Sinatra is a DSL intended for quickly creating web-applications in Ruby with minimal effort. Security Fix(es): Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.(CVE-2022-45442)

RHSA-2023:0393 — Red Hat Security Advisory: pcs security update

sinatra: Reflected File Download attack

RHSA-2023:0855 — Red Hat Security Advisory: pcs security update

sinatra: Reflected File Download attack

UBUNTU-CVE-2022-45442

Affected: Ubuntu:Pro:16.04:LTS: ruby-sinatra, Ubuntu:Pro:18.04:LTS: ruby-sinatra, Ubuntu:22.04:LTS: ruby-sinatra

WID-SEC-W-2023-0186 — Red Hat Enterprise Linux: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um Sicherheitsvorkehrungen zu umgehen.