{"id":"CVE-2022-29970","aliases":["ALSA-2022:4587","ALSA-2022:4661","DEBIAN-CVE-2022-29970","DLA-3166-1","DLA-3877-1","EUVD-2022-5007","GHSA-qp49-3pvw-x4m5","MGASA-2022-0280","RHSA-2022:2253","RHSA-2022:2255","RHSA-2022:2256","RHSA-2022:4587","RHSA-2022:4661","RHSA-2022:8506","RLSA-2022:4661","RLSA-2022:8506","SUSE-SU-2022:1729-1","SUSE-SU-2022:2046-1","UBUNTU-CVE-2022-29970","USN-7664-1"],"status":"published","title":"sinatra does not validate expanded path matches","description":"Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02137,"percentile":0.82169,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22","CWE-426"],"published":"2022-05-02T00:00:00Z","modified":"2026-11-03T08:00:44Z","fixes":[{"ecosystem":"RubyGems","package":"sinatra","fixed_in":["2.2.0"],"sources":["ghsa","osv"]},{"ecosystem":"AlmaLinux:9","package":"pcs","fixed_in":["0.11.1-10.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"pcs-snmp","fixed_in":["0.11.1-10.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"pcs","fixed_in":["0.10.12-6.el8.alma"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"pcs-snmp","fixed_in":["0.10.12-6.el8.alma"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"ruby-sinatra","fixed_in":["2.2.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-sinatra","fixed_in":["2.2.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-sinatra","fixed_in":["2.2.2-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"ruby-sinatra","fixed_in":["2.0.5-4+deb10u1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"ruby-sinatra","fixed_in":["2.0.8.1-1.1.mga8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::highavailability","package":"pcs","fixed_in":["0:0.10.4-6.el8_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::highavailability","package":"pcs-snmp","fixed_in":["0:0.10.4-6.el8_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::resilientstorage","package":"pcs","fixed_in":["0:0.10.4-6.el8_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::resilientstorage","package":"pcs-snmp","fixed_in":["0:0.10.4-6.el8_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.1::highavailability","package":"pcs","fixed_in":["0:0.10.2-4.el8_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.1::highavailability","package":"pcs-snmp","fixed_in":["0:0.10.2-4.el8_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.4::highavailability","package":"pcs","fixed_in":["0:0.10.8-1.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.4::highavailability","package":"pcs-snmp","fixed_in":["0:0.10.8-1.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.4::resilientstorage","package":"pcs","fixed_in":["0:0.10.8-1.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.4::resilientstorage","package":"pcs-snmp","fixed_in":["0:0.10.8-1.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::highavailability","package":"pcs","fixed_in":["0:0.11.1-10.el9_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::highavailability","package":"pcs-snmp","fixed_in":["0:0.11.1-10.el9_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"pcs","fixed_in":["0:0.11.1-10.el9_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"pcs-snmp","fixed_in":["0:0.11.1-10.el9_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"pcs","fixed_in":["0:0.10.12-6.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"pcs-snmp","fixed_in":["0:0.10.12-6.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"pcs","fixed_in":["0:0.10.12-6.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"pcs-snmp","fixed_in":["0:0.10.12-6.el8_6.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"pcs","fixed_in":["0:0.10.12-6.el8_6.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"rubygem-sinatra","fixed_in":["1.4.6-3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ruby-sinatra","fixed_in":["1.4.7-3ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby-sinatra","fixed_in":["1.4.8-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"ruby-sinatra","fixed_in":["2.0.8.1-2+deb11u1build0.22.04.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.1-10.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.1-10.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.12-6.el8.alma"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.12-6.el8.alma"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.5-4+deb10u1"}]}],"versions":["2.0.5-4"]},{"source":"osv","ecosystem":"Debian:11","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8.1-2+deb11u1"}]}],"versions":["2.0.8.1-2"],"bundled":2},{"source":"osv","ecosystem":"RubyGems","package":"sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0"}]}],"versions":["0.1.0","0.1.5","0.1.6","0.1.7","0.2.0","0.2.1","0.2.2","0.3.0","0.3.1","0.3.2","0.3.3","0.9.0","0.9.0.1","0.9.0.2","0.9.0.3","0.9.0.4","0.9.0.5","0.9.1","0.9.1.1","0.9.2","0.9.4","0.9.5","0.9.6","1.0","1.0.a","1.0.b","1.1.0","1.1.2","1.1.3","1.1.4","1.1.a","1.1.b","1.2.0","1.2.0.a","1.2.0.c","1.2.0.d","1.2.1","1.2.2","1.2.3","1.2.6","1.2.7","1.2.8","1.2.9","1.3.0","1.3.0.a","1.3.0.b","1.3.0.c","1.3.0.d","1.3.0.e","1.3.0.f","1.3.0.g","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.4.0","1.4.0.a","1.4.0.b","1.4.0.c","1.4.0.d","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","2.0.0","2.0.0.beta1","2.0.0.beta2","2.0.0.rc1","2.0.0.rc2","2.0.0.rc5","2.0.0.rc6","2.0.1","2.0.1.rc1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.8.1","2.1.0"]},{"source":"osv","ecosystem":"Mageia:8","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8.1-1.1.mga8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-6.el8_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-6.el8_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::resilientstorage","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-6.el8_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::resilientstorage","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-6.el8_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.2-4.el8_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.2-4.el8_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.8-1.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.8-1.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::resilientstorage","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.8-1.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::resilientstorage","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.8-1.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.1-10.el9_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.1-10.el9_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.1-10.el9_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.1-10.el9_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.12-6.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.12-6.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.12-6.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.12-6.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"candlepin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.15-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"candlepin-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.15-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.14-2.el8pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"python39-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.14-2.el8pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.14-2.el8pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"python39-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.14-2.el8pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.8-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.8-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"rubygem-nokogiri-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.8-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.8-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.8-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"rubygem-nokogiri-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.8-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"rubygem-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.0-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"rubygem-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.0-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"rubygem-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.0-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"rubygem-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.3-2.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.12::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.12::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-gce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:8","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.12-6.el8_6.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.28-42.el8_4"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1644879908.8a641c1-3.13.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.4-3.26.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.1~dev24-3.14.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.10~dev24-3.34.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-heat-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev4-3.9.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-horizon-plugin-gbp-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev3-3.9.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.5~dev18-3.28.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1~dev9-3.28.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev206-3.40.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-neutron-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev33-3.31.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-3.17.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-XStatic-jquery-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0.1-4.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-3.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"release-notes-suse-openstack-cloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20220413-3.30.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.1~dev24-3.35.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.10~dev24-3.38.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.2~dev2-3.35.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.1~dev30-3.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.4~dev4-3.35.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.1.1~dev11-4.39.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.5~dev18-4.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1~dev9-3.36.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-magnum","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.1~dev1-4.35.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-manila","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.2~dev60-3.41.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1~dev10-3.37.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-monasca-ceilometer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2~dev3-3.35.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev206-6.39.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.3.1~dev91-3.39.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3~dev7-4.35.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-sahara","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2~dev15-3.35.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.2~dev48-2.30.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.4-3.26.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.1~dev24-3.14.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.10~dev24-3.34.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-heat-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev4-3.9.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-horizon-plugin-gbp-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev3-3.9.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.5~dev18-3.28.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1~dev9-3.28.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev206-3.40.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-neutron-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev33-3.31.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-3.17.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-XStatic-jquery-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0.1-4.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-3.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"release-notes-suse-openstack-cloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20220413-3.30.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"rubygem-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-4.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"rubygem-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-3ubuntu0.1~esm2"}]}],"versions":["1.4.6-2","1.4.7-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8-1ubuntu0.1~esm2"}]}],"versions":["1.4.7-5","1.4.8-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8.1-2+deb11u1build0.22.04.1"}]}],"versions":["2.0.8.1-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-3ubuntu0.1~esm2"}]}],"versions":["1.4.6-2","1.4.7-3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8-1ubuntu0.1~esm2"}]}],"versions":["1.4.7-5","1.4.8-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8.1-1ubuntu0.1~esm2"}]}],"versions":["2.0.5-4ubuntu1","2.0.8.1-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8.1-2+deb11u1build0.22.04.1"}]}],"versions":["2.0.8.1-2"],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"sinatrarb","product":"sinatra"}],"references":[{"url":"https://github.com/sinatra/sinatra/pull/1683/commits/462c3ca1db53ed3cfc394cf5948e9c948ad1c10e","tags":["x_transferred","Patch","Third Party Advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/10/msg00034.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00020.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29970","tags":["advisory"]},{"url":"https://github.com/skylightio/skylight-ruby/pull/294","tags":["web"]},{"url":"https://github.com/sinatra/sinatra/pull/1683","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sinatra/CVE-2022-29970.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qp49-3pvw-x4m5"},{"url":"https://access.redhat.com/errata/RHSA-2022:4587","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-29970","tags":["report"]},{"url":"https://bugzilla.redhat.com/2081096","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2022-4587.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-4661.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2022-29970","tags":["report"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29970.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-29970","tags":["advisory"]},{"url":"https://github.com/sinatra/sinatra","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2022-0280.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30542","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2022-June/011265.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2022:2253","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2081096","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_2253.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-29970","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2022:2255","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_2255.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:2256","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_2256.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_4587.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:4661","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2081331","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_4661.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:8506","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1309740","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1703496","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1732590","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1775813","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1829468","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1830968","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1834897","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1850393","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1868175","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1868323","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1870816","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1879811","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1884148","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1892218","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1892752","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1894033","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1908841","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1912941","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1925165","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1930577","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1931532","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1931665","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1934210","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1938092","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1940396","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1951542","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1952939","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1959136","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1962253","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1964080","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1970132","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1970623","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1971747","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1973329","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1974180","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1981444","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1982698","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1982745","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1984400","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1989631","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1990119","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1991557","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1994877","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1994945","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1998477","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2000613","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2001517","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2001552","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2004133","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2004135","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2006974","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2007117","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2011312","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2013611","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2015062","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2015757","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2016924","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2022065","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2022649","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024175","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024576","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024968","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025892","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025926","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2027947","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2028112","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2033321","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2033381","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2035287","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2036151","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2038989","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2043126","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2043242","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048547","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048775","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2049595","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051648","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051891","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2052076","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053842","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054011","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054042","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054786","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054969","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055391","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055416","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055979","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056188","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056702","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2058037","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2059179","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2060651","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2062800","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064979","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2068454","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2069306","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2069440","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2069634","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2070001","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2070535","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2070732","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2070972","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072696","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2073305","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2074346","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2075056","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2076843","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2077811","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2077822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2077824","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2080324","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2080423","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2084130","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2085490","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2088303","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2089445","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2089828","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2091044","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2092039","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2093884","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2094019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2095187","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2095820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2096429","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2098240","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2099620","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2100578","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2100887","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2101579","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2101882","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2101986","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102145","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102456","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102825","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102867","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102896","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103096","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103099","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103102","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103106","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103110","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103129","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103522","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2104401","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2104498","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105048","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105107","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105144","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105299","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105941","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106000","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106090","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106091","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106092","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106093","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106333","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106659","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106691","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106700","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106885","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107252","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107572","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107577","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107701","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2108169","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2108611","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2108637","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2108719","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109254","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109260","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109298","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109421","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109594","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109606","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109810","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2110003","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2110163","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2110222","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2110731","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2110872","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111038","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111074","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111222","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111373","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111469","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111570","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111571","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111578","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111921","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2112015","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2112093","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2112098","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2112436","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2112979","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2113013","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2113905","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2113946","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2113996","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115229","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115686","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115767","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115775","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115832","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2116123","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2116276","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2116385","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2116871","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2117382","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2117489","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2117522","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118055","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118252","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118356","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118431","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118689","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118694","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118772","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118790","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118950","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118966","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119112","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119117","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119120","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119124","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119190","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119234","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119688","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120148","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120224","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120299","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120327","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120414","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120579","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120632","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120715","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120992","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121238","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121249","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121583","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121689","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121738","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121739","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121954","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2122090","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2122214","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2122764","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2122780","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2122945","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2123352","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2123405","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124047","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124051","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124087","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124271","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124568","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124663","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124850","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124851","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124928","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2125022","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2125244","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2125317","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2125585","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2125669","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2127099","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2127318","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2127934","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2127940","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2128209","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2128422","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2129002","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2131729","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2133468","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2139368","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2139369","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2139371","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8506.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-37136","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-37136","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-37136","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-37137","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-37137","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-37137","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22818","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22818","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2022/feb/01/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24836","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24836","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24836","tags":["advisory"]},{"url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25648","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25648","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25648","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-RUBY-GIT-2421270","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-29181","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2088684","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-29181","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29181","tags":["advisory"]},{"url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xh29-r2w5-wx8m","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-32209","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-32209","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32209","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-34265","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-34265","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-34265","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-6861","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2317450","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-6861","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6861","tags":["advisory"]},{"url":"https://docs.theforeman.org/3.3/Release_Notes/index-katello.html#_foreman_2","tags":["article"]},{"url":"https://projects.theforeman.org/issues/34328","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2022:4661","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:8506","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221729-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1118088","tags":["report"]},{"url":"https://bugzilla.suse.com/1179534","tags":["report"]},{"url":"https://bugzilla.suse.com/1184177","tags":["report"]},{"url":"https://bugzilla.suse.com/1186380","tags":["report"]},{"url":"https://bugzilla.suse.com/1189390","tags":["report"]},{"url":"https://bugzilla.suse.com/1189794","tags":["report"]},{"url":"https://bugzilla.suse.com/1192070","tags":["report"]},{"url":"https://bugzilla.suse.com/1192073","tags":["report"]},{"url":"https://bugzilla.suse.com/1192075","tags":["report"]},{"url":"https://bugzilla.suse.com/1193597","tags":["report"]},{"url":"https://bugzilla.suse.com/1193688","tags":["report"]},{"url":"https://bugzilla.suse.com/1193752","tags":["report"]},{"url":"https://bugzilla.suse.com/1194521","tags":["report"]},{"url":"https://bugzilla.suse.com/1194551","tags":["report"]},{"url":"https://bugzilla.suse.com/1194552","tags":["report"]},{"url":"https://bugzilla.suse.com/1194952","tags":["report"]},{"url":"https://bugzilla.suse.com/1194954","tags":["report"]},{"url":"https://bugzilla.suse.com/1199138","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-40085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-44716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29970","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222046-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-29970","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7664-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-45442","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-29970","description":"Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.","status":"published","published":"2022-05-02T00:00:00Z","modified":"2025-11-04T16:09:45.37Z","updated_at":"2026-11-02T14:34:35.945659Z"}],"euvd":[{"id":"EUVD-2022-5007","description":"Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.","status":"published","published":"2022-05-02T00:00:00Z","modified":"2025-11-04T16:09:45Z","updated_at":"2026-11-02T19:49:29.391161Z"}],"ghsa":[{"id":"GHSA-qp49-3pvw-x4m5","title":"sinatra does not validate expanded path matches","description":"Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.","status":"published","published":"2022-05-03T00:00:43Z","modified":"2025-11-04T19:36:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22","CWE-426"],"updated_at":"2026-11-02T14:39:06.376137Z"}],"nvd":[{"id":"CVE-2022-29970","description":"Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.","status":"published","published":"2022-05-02T05:15:06.767Z","modified":"2026-06-17T04:41:03.527Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:07:18.660414Z"}],"osv":[{"id":"DEBIAN-CVE-2022-29970","description":"Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.","status":"published","published":"2022-05-02T05:15:06.767Z","modified":"2026-11-03T08:00:44.509312019Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T08:25:15.646766Z"},{"id":"GHSA-qp49-3pvw-x4m5","title":"sinatra does not validate expanded path matches","description":"Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.","status":"published","published":"2022-05-03T00:00:43Z","modified":"2025-11-04T19:59:48.796726Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22","CWE-426"],"updated_at":"2026-11-02T15:46:54.760124Z"},{"id":"RHSA-2022:2253","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2024-09-13T21:00:54Z","modified":"2026-06-29T10:41:36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:2255","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2024-09-13T21:00:35Z","modified":"2026-06-29T10:41:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:2256","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2024-09-13T21:00:44Z","modified":"2026-06-29T10:41:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:4587","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2024-09-13T21:01:10Z","modified":"2026-06-29T10:41:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:4661","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2024-09-13T21:01:02Z","modified":"2026-06-29T10:41:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:8506","title":"Red Hat Security Advisory: Satellite 6.12 Release","status":"published","published":"2024-09-29T19:10:39Z","modified":"2026-10-13T10:03:33Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RLSA-2022:4661","title":"Important: pcs security update","description":"The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.\n\nSecurity Fix(es):\n\n* sinatra: path traversal possible outside of public_dir when serving static files (CVE-2022-29970)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-05-18T13:52:10Z","modified":"2026-02-04T22:15:09.166633Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2022-29970","description":"Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.","status":"published","published":"2022-05-02T05:15:00Z","modified":"2026-07-22T20:46:35.408385513Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:53:53.899276Z"},{"id":"ALSA-2022:4587","title":"Important: pcs security update","description":"The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.\nSecurity Fix(es):\n* sinatra: path traversal possible outside of public_dir when serving static files (CVE-2022-29970)\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-05-18T00:00:00Z","modified":"2026-10-29T11:31:10.613945885Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"ALSA-2022:4661","title":"Important: pcs security update","description":"The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.\n\nSecurity Fix(es):\n\n* sinatra: path traversal possible outside of public_dir when serving static files (CVE-2022-29970)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-05-18T13:52:10Z","modified":"2026-10-29T11:01:04.598119344Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"CVE-2022-29970","description":"Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.","status":"published","published":"2022-05-02T00:00:00Z","modified":"2026-10-28T02:30:54.659903565Z","updated_at":"2026-11-02T15:44:25.516981Z"},{"id":"DLA-3166-1","title":"ruby-sinatra - security update","status":"published","published":"2022-10-28T00:00:00Z","modified":"2026-03-09T01:18:39.634042Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-3877-1","title":"ruby-sinatra - security update","status":"published","published":"2024-09-05T00:00:00Z","modified":"2026-03-09T01:21:08.532946Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2022-0280","title":"Updated ruby-sinatra packages fix security vulnerability","description":"Sinatra before 2.2.0 does not validate that the expanded path matches\npublic_dir when serving static files. (CVE-2022-29970)\n","status":"published","published":"2022-08-13T02:32:35Z","modified":"2026-04-16T04:43:08.061243145Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"RLSA-2022:8506","title":"Important: Satellite 6.12 Release","description":"Rocky Enterprise Software Foundation Satellite is a systems management tool for Linux-based\ninfrastructure. It allows for provisioning, remote management, and\nmonitoring of multiple Linux deployments with a single centralized tool.\n\nSecurity Fix(es):\n* netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data (CVE-2021-37136)\n* netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way (CVE-2021-37137)\n* python3-django: Possible XSS via template tag (CVE-2022-22818)\n* tfm-rubygem-nokogiri: ReDoS in HTML encoding detection (CVE-2022-24836)\n* tfm-rubygem-sinatra: Path traversal possible outside of public_dir when serving static files (CVE-2022-29970)\n* tfm-rubygem-git: Package vulnerable to Command Injection via git argument injection (CVE-2022-25648)\n* rubygem-rails-html-sanitizer: Possible XSS with certain configurations (CVE-2022-32209)\n* python3-django: Potential SQL injection via Trunc and Extract arguments (CVE-2022-34265)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section.\n\nAdditional Changes:\n\nThe items above are not a complete list of changes. This update also fixes\nseveral bugs and adds various enhancements. Documentation for these changes\nis available from the Release Notes document.","status":"published","published":"2022-11-16T13:21:30Z","modified":"2026-02-04T16:00:10.880515Z","updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"SUSE-SU-2022:1729-1","title":"Security update for ardana-barbican, grafana, openstack-barbican, openstack-cinder, openstack-heat-gbp, openstack-horizon-plugin-gbp-ui, openstack-ironic, openstack-keystone, openstack-neutron-gbp, python-lxml, release-notes-suse-openstack-cloud","description":"This update for ardana-barbican, grafana, openstack-barbican, openstack-cinder, openstack-heat-gbp, openstack-horizon-plugin-gbp-ui, openstack-ironic, openstack-keystone, openstack-neutron-gbp, python-lxml, release-notes-suse-openstack-cloud fixes the following issues:\n\nSecurity fixes included on the update:\n\nardana-barbican:\n\n- Update policies to protect container secret access (SOC-11621)\n- Update policies to protect secret metadata access (SOC-11620)\n\nopenstack-neutron:\n\n- CVE-2021-40085: Fixed arbitrary dnsmasq reconfiguration via extra_dhcp_opts (bsc#1189794).\n\nrubygem-sinatra:\n\n- CVE-2022-29970: Fixed path traversal possible outside of public_dir when serving static files (bsc#1199138).\n\npython-XStatic-jquery-ui:\n\n- CVE-2021-41182: Fixed XSS in the `altField` option of the Datepicker widget (bsc#1192070)\n- CVE-2021-41183: Fixed XSS in the `of` option of the `.position()` util (bsc#1192073)\n- CVE-2021-41184: Fixed XSS in `*Text` options of the Datepicker widget (bsc#1192075)\n\npython-lxml:\n\n- CVE-2018-19787: Fixed that the lxml.html.clean module does remove javascript in lxml/html/clean.py (bsc#1118088).\n- CVE-2020-27783: Fixed mXSS due to the use of improper parser (bsc#1179534).\n- CVE-2021-28957: Fixed missing input sanitization for formaction HTML5 attributes that may have led to XSS (bsc#1184177).\n- CVE-2021-43818: Fixed HTML Cleaner that allowed crafted and SVG embedded scripts to pass through (bsc#1193752).\n\nopenstack-barbican:\n\n- CVE-2022-23451: Disallows authenticated users to add/modify/delete arbitrary metadata on any secret (bsc#1194952).\n- CVE-2022-23452: Disallows anyone with an admin role to add their secrets to a different project's containers (bsc#1194954).\n\ngrafana:\n\n- CVE-2021-44716: Fixed net/http: limit growth of header canonicalization cache (bsc#1193597).\n\nopenstack-keystone:\n\n- CVE-2021-38155: Fixed information disclosure during account locking (bsc#1189390).\n\nNon-security fixes included on the update:\n\nChanges in ardana-barbican:\n- Update to version 9.0+git.1644879908.8a641c1:\n  * Update policies to protect container secret access (SOC-11621)\n\n- Update to version 9.0+git.1643052417.9a3348e:\n  * update policies to protect secret metadata access (SOC-11620)\n\nChanges in grafana:\n- Add CVE-2021-43813.patch (bsc#1193688, CVE-2021-43813)\n  * directory traversal vulnerability for .md files \n\n- Bump Go to 1.16 (bsc#1193597, CVE-2021-44716)\n  * Fix Go net/http: limit growth of header canonicalization cache\n\nChanges in openstack-barbican:\n- Add patches (0001-Fix-RBAC-and-ACL-access-for-managing-secret-containe.patch\n  and 0001-Fix-policy-for-adding-a-secret-to-a-container.patch) to fix\n  the legacy policy rules for adding a secret to a container and removing\n  a secret from a container. bsc#1194954,CVE-2022-23452\n\n- Add patch (0001-Fix-secret-metadata-access-rules.patch) to fix the\n  legacy policy rules for accessing secret metadata by checking that\n  the user making the request is authenticated for the project that\n  owns the secret. bsc#1194952,CVE-2022-23451\n\nChanges in openstack-cinder:\n- Update to version cinder-13.0.10.dev24:\n  * Correct group:reset\\_group\\_snapshot\\_status policy\n\nChanges in openstack-cinder:\n- Update to version cinder-13.0.10.dev24:\n  * Correct group:reset\\_group\\_snapshot\\_status policy\n\nChanges in openstack-heat-gbp:\n- Update to version group-based-policy-automation-14.0.1.dev4:\n  * Add support for yoga\n\n- Update to version group-based-policy-automation-14.0.1.dev3:\n  * Python2/3 compatibility fixes\n\n- Update to version group-based-policy-automation-14.0.1.dev2:\n  * Add support for xena\n\n- Update to version group-based-policy-automation-14.0.1.dev1:\n  * Remove py27 from gate jobs\n  14.0.0\n\nChanges in openstack-horizon-plugin-gbp-ui:\n- Update to version group-based-policy-ui-14.0.1.dev3:\n  * Add support for yoga\n\n- Update to version group-based-policy-ui-14.0.1.dev2:\n  * Python2/3 compatibility changes\n\n- Update to version group-based-policy-ui-14.0.1.dev1:\n  * Add support for xena\n  14.0.0\n\nChanges in openstack-ironic:\n- Update to version ironic-11.1.5.dev18:\n  * Cleanup stable/rocky legacy jobs\n\nChanges in openstack-ironic:\n- Update to version ironic-11.1.5.dev18:\n  * Cleanup stable/rocky legacy jobs\n\nChanges in openstack-keystone:\n- Update to version keystone-14.2.1.dev9:\n  * Delete system role assignments from system\\_assignment table\n\nChanges in openstack-keystone:\n- Add patch (0001-Hide-AccountLocked-exception-from-end-users.patch) to fix\n  the problem where AccountLocked exception discloses sensitive information.\n  bsc#1189390,CVE-2021-38155\n\n- Update to version keystone-14.2.1.dev9:\n  * Delete system role assignments from system\\_assignment table\n\nChanges in openstack-neutron-gbp:\n- Update to version group-based-policy-14.0.1.dev33:\n  * Populate network mtu for erspan\n\n- Update to version group-based-policy-14.0.1.dev32:\n  * ERSPAN config error when Openstack port is created in a different project than network it belongs to\n  2014.2.rc1\n\n- Update to version group-based-policy-14.0.1.dev31:\n  * Python2/3 compatibility fixes\n  2014.2.0rc1\n\n- Update to version group-based-policy-14.0.1.dev29:\n  * Fix oslo\\_i18n usage\n\n- Update to version group-based-policy-14.0.1.dev27:\n  * Update mechanism\\_driver cache\n  2014.2.rc1\n\n- Update to version group-based-policy-14.0.1.dev26:\n  * Add support for xena\n\n- Update to version group-based-policy-14.0.1.dev24:\n  * update\\_floatingip\\_status\\_while\\_deleting\\_the\\_vm\n\n- Update to version group-based-policy-14.0.1.dev22:\n  * Updating host id by appending pid in existing host id\n  2014.2.0rc1\n\n- Update to version group-based-policy-14.0.1.dev20:\n  * Revert 'Add workaround to get\\_subnets'\n\nChanges in python-lxml:\n- Fix bsc#1179534 (CVE-2020-27783)\n  mXSS due to the use of improper parser \n  Patch files: 0001-CVE-2020-27783.patch 0002-CVE-2020-27783.patch\n- Fix bsc#1118088 (CVE-2018-19787)\n  lxml/html/clean.py in the lxml.html.clean module does not remove\n  javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks\n  Patch file: 0001-CVE-2018-19787.patch\n- Fix bsc#1184177 (CVE-2021-28957)\n  missing input sanitization for formaction HTML5 attributes may lead to XSS\n  Patch file: 0001-CVE-2021-28957.patch\n- Fix bsc#1193752 (CVE-2021-43818)\n  Cleaner: Remove SVG image data URLs since they can embed script content.\n  Reported as GHSL-2021-1037 and GHSL-2021-1038 \n  Patch files 0001-CVE-2021-43818.patch 0002-CVE-2021-43818.patch\n\nChanges in openstack-neutron-doc:\n- Update to version neutron-13.0.8.dev206:\n  * Wait longer before deleting DPDK vhu trunk bridges\n\n- Update to version neutron-13.0.8.dev205:\n  * Do no use '--strict' for OF deletion in TRANSIENT\\_TABLE\n\n- Update to version neutron-13.0.8.dev203:\n  * Populate self.floating\\_ips\\_dict using 'ip rule' information\n\n- Update to version neutron-13.0.8.dev201:\n  * [Functional] Wait for the initial state of ha router before test\n  * Don't setup bridge controller if it is already set\n\n- Update to version neutron-13.0.8.dev198:\n  * Remove dhcp\\_extra\\_opt name after first newline character\n\n- Update to version neutron-13.0.8.dev196:\n  * [L3] Use processing queue for network update events\n  * Add extra logs to the network update callback in L3 agent\n\n- Update to version neutron-13.0.8.dev192:\n  * Remove dhcp\\_extra\\_opt value after first newline character\n\n- Update to version neutron-13.0.8.dev190:\n  * Don't use singleton in routes.middleware.RoutesMiddleware\n\n- Update to version neutron-13.0.8.dev189:\n  * Fix notify listener syntax for SEGMENT\\_HOST\\_MAPPING\n\n- Update to version neutron-13.0.8.dev188:\n  * Clean port forwarding cache when router is DOWN\n\n- Update to version neutron-13.0.8.dev186:\n  * Remove FIP agent's gw port when L3 agent is deleted\n\n- Update to version neutron-13.0.8.dev184:\n  * Force to close http connection after notify about HA router status\n\n- Update to version neutron-13.0.8.dev183:\n  * Don't configure dnsmasq entries for 'network' ports\n\n- Update to version neutron-13.0.8.dev181:\n  * Exclude fallback tunnel devices from netns cleanup\n\n- Update to version neutron-13.0.8.dev180:\n  * [DVR] Send allowed address pairs info to the L3 agents\n  * designate: allow PTR zone creation to fail\n  * Don't try to create default SG when security groups are disabled\n\n- Update to version neutron-13.0.8.dev174:\n  * Fix update of trunk subports during live migration\n\n- Update to version neutron-13.0.8.dev172:\n  * [ovs fw] Restrict IPv6 NA and DHCP(v6) IP and MAC source addresses\n\n- Update to version neutron-13.0.8.dev170:\n  * Call install\\_ingress\\_direct\\_goto\\_flows() when ovs restarts\n\n- Update to version neutron-13.0.8.dev168:\n  * Fix multicast traffic with IGMP snooping enabled\n\n- Update to version neutron-13.0.8.dev166:\n  * Fix OVS conjunctive IP flows cleanup\n\nChanges in openstack-neutron:\n- Update to version neutron-13.0.8.dev206:\n  * Wait longer before deleting DPDK vhu trunk bridges\n\n- Update to version neutron-13.0.8.dev205:\n  * Do no use '--strict' for OF deletion in TRANSIENT\\_TABLE\n\n- Update to version neutron-13.0.8.dev203:\n  * Populate self.floating\\_ips\\_dict using 'ip rule' information\n\n- Update to version neutron-13.0.8.dev201:\n  * [Functional] Wait for the initial state of ha router before test\n  * Don't setup bridge controller if it is already set\n\n- Update to version neutron-13.0.8.dev198:\n  * Remove dhcp\\_extra\\_opt name after first newline character\n\n- Update to version neutron-13.0.8.dev196:\n  * [L3] Use processing queue for network update events\n  * Add extra logs to the network update callback in L3 agent\n\n- Remove cve-2021-40085-stable-rocky.patch (merged upstream)\n\n- Update to version neutron-13.0.8.dev192:\n  * Remove dhcp\\_extra\\_opt value after first newline character\n\n- Update to version neutron-13.0.8.dev190:\n  * Don't use singleton in routes.middleware.RoutesMiddleware\n\n- Update to version neutron-13.0.8.dev189:\n  * Fix notify listener syntax for SEGMENT\\_HOST\\_MAPPING\n\n- Add cve-2021-40085-stable-rocky.patch (bsc#1189794, CVE-2021-40085) \n  * Remove dhcp_extra_opt value after first newline character\n\n- Update to version neutron-13.0.8.dev188:\n  * Clean port forwarding cache when router is DOWN\n\n- Update to version neutron-13.0.8.dev186:\n  * Remove FIP agent's gw port when L3 agent is deleted\n\n- Update to version neutron-13.0.8.dev184:\n  * Force to close http connection after notify about HA router status\n\n- Update to version neutron-13.0.8.dev183:\n  * Don't configure dnsmasq entries for 'network' ports\n\n- Update to version neutron-13.0.8.dev181:\n  * Exclude fallback tunnel devices from netns cleanup\n\n- Update to version neutron-13.0.8.dev180:\n  * [DVR] Send allowed address pairs info to the L3 agents\n  * designate: allow PTR zone creation to fail\n  * Don't try to create default SG when security groups are disabled\n\n- Update to version neutron-13.0.8.dev174:\n  * Fix update of trunk subports during live migration\n\n- Update to version neutron-13.0.8.dev172:\n  * [ovs fw] Restrict IPv6 NA and DHCP(v6) IP and MAC source addresses\n\n- Update to version neutron-13.0.8.dev170:\n  * Call install\\_ingress\\_direct\\_goto\\_flows() when ovs restarts\n\n- Update to version neutron-13.0.8.dev168:\n  * Fix multicast traffic with IGMP snooping enabled\n\n- Update to version neutron-13.0.8.dev166:\n  * Fix OVS conjunctive IP flows cleanup\n\nChanges in python-Pillow:\n- Add 030-CVE-2022-22817.patch\n   * From upstream, backported\n   * Fixes CVE-2022-22817, bsc#1194521 \n   * test from upstream updated for python2\n\n- Add 028-CVE-2022-22815.patch\n   * From upstream, backported\n   * Fixes CVE-2022-22815, bsc#1194552\n- Add 029-CVE-2022-22816.patch\n   * From upstream, backported\n   * Fixes CVE-2022-22816, bsc#1194551\n\nChanges in python-XStatic-jquery-ui:\n- Update to version 1.13.0.1 (bsc#1192070, CVE-2021-41182, bsc#1192073,\n  CVE-2021-41184, bsc#1192075,  CVE-2021-41183)\n    * Fix XSS in the altField option of the Datepicker widget \n     (CVE-2021-41182)\n    * Fix XSS in *Text options of the Datepicker widget\n     (CVE-2021-41183)\n    * Fix XSS in the of option of the .position() util\n      (CVE-2021-41184)\n    * Drop support for Query 1.7\n    * Accordion: allow function parameter for selecting header\n      elements\n    * Datepicker: add optional onUpdateDatepicker callback\n\nChanges in release-notes-suse-openstack-cloud:\n- Update to version 9.20220413:\n  * Update release notes to indicate support for SES7\n- Update to version 9.20220112:\n  * Add reference to keystone bcrypt issue to known limitations (bsc#1186380)\n\nChanges in rubygem-sinatra:\n- Add CVE-2022-29970.patch (bsc#1199138, CVE-2022-29970)\n\n  ","status":"published","published":"2022-05-18T14:55:52Z","modified":"2026-02-04T03:56:30.500919Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:2046-1","title":"Security update for rubygem-sinatra","description":"This update for rubygem-sinatra fixes the following issues:\n\n- CVE-2022-29970: Fixed possible path traversal outside of public_dir when serving static files (bsc#1199138).\n","status":"published","published":"2022-06-11T08:05:27Z","modified":"2026-02-04T03:07:41.366113Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"USN-7664-1","title":"ruby-sinatra vulnerabilities","description":"It was discovered that Sinatra incorrectly handled serving static files.\nAn attacker could possibly use this issue to perform local file inclusion,\nobtaining sensitive information.\n(CVE-2022-29970)\n\nIt was discovered that Sinatra incorrectly handled special characters in\nthe Content-Disposition HTTP header. An attacker could possibly use this\nissue to perform a reflected file download attack, achieving remote code\nexecution. (CVE-2022-45442)","status":"published","published":"2025-07-22T12:17:53Z","modified":"2026-06-25T13:32:30.656145132Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}