{"id":"CVE-2022-45442","aliases":["ALSA-2023:0855","ALSA-2023:0974","CLSA-2026-1790610952","CLSA-2026-1790611274","DEBIAN-CVE-2022-45442","DLA-3264-1","DLA-3877-1","EUVD-2022-7200","GHSA-2x8x-jmrp-phxw","MGASA-2023-0029","OESA-2024-2474","OESA-2024-2475","OESA-2024-2476","OESA-2024-2477","OESA-2024-2490","RHSA-2023:0393","RHSA-2023:0427","RHSA-2023:0506","RHSA-2023:0527","RHSA-2023:0855","RHSA-2023:0857","RHSA-2023:0974","RLSA-2023:0855","UBUNTU-CVE-2022-45442","USN-7664-1"],"status":"published","title":"Sinatra vulnerable to Reflected File Download attack","description":"Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00694,"percentile":0.53233,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-494"],"published":"2022-11-28T00:00:00Z","modified":"2026-11-03T06:03:01Z","exploits":[{"source":"pocgithub","id":"boost-legal/refile","title":"boost-legal/refile","date":"2026-06-30","url":"https://github.com/boost-legal/refile"}],"fixes":[{"ecosystem":"RubyGems","package":"sinatra","fixed_in":["3.0.4","2.2.3"],"sources":["ghsa","osv"]},{"ecosystem":"AlmaLinux:8","package":"pcs","fixed_in":["0.10.14-5.el8_7.2.alma"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"pcs-snmp","fixed_in":["0.10.14-5.el8_7.2.alma"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"pcs","fixed_in":["0.11.3-4.el9_1.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"pcs-snmp","fixed_in":["0.11.3-4.el9_1.2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"ruby-sinatra","fixed_in":["3.0.5-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-sinatra","fixed_in":["3.0.5-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-sinatra","fixed_in":["3.0.5-2"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"ruby-sinatra","fixed_in":["2.0.5-4+deb10u2"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"ruby-sinatra","fixed_in":["2.0.8.1-1.2.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"rubygem-sinatra","fixed_in":["2.0.8.1-3.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"rubygem-sinatra","fixed_in":["2.0.8.1-4.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"rubygem-sinatra","fixed_in":["2.0.8.1-3.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"rubygem-sinatra","fixed_in":["2.0.8.1-3.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"rubygem-sinatra","fixed_in":["2.0.3-3.oe2003sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.2::highavailability","package":"pcs","fixed_in":["0:0.10.4-6.el8_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.2::highavailability","package":"pcs-snmp","fixed_in":["0:0.10.4-6.el8_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.2::highavailability","package":"pcs","fixed_in":["0:0.10.4-6.el8_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.2::highavailability","package":"pcs-snmp","fixed_in":["0:0.10.4-6.el8_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::highavailability","package":"pcs","fixed_in":["0:0.10.12-6.el8_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::highavailability","package":"pcs-snmp","fixed_in":["0:0.10.12-6.el8_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::resilientstorage","package":"pcs","fixed_in":["0:0.10.12-6.el8_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::resilientstorage","package":"pcs-snmp","fixed_in":["0:0.10.12-6.el8_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.4::highavailability","package":"pcs","fixed_in":["0:0.10.8-1.el8_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.4::highavailability","package":"pcs-snmp","fixed_in":["0:0.10.8-1.el8_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.4::resilientstorage","package":"pcs","fixed_in":["0:0.10.8-1.el8_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.4::resilientstorage","package":"pcs-snmp","fixed_in":["0:0.10.8-1.el8_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.0::highavailability","package":"pcs","fixed_in":["0:0.11.1-10.el9_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.0::highavailability","package":"pcs-snmp","fixed_in":["0:0.11.1-10.el9_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.0::resilientstorage","package":"pcs","fixed_in":["0:0.11.1-10.el9_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.0::resilientstorage","package":"pcs-snmp","fixed_in":["0:0.11.1-10.el9_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"pcs","fixed_in":["0:0.10.14-5.el8_7.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"pcs-snmp","fixed_in":["0:0.10.14-5.el8_7.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"pcs","fixed_in":["0:0.10.14-5.el8_7.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"pcs-snmp","fixed_in":["0:0.10.14-5.el8_7.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.1::highavailability","package":"pcs","fixed_in":["0:0.10.2-4.el8_1.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.1::highavailability","package":"pcs-snmp","fixed_in":["0:0.10.2-4.el8_1.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::highavailability","package":"pcs","fixed_in":["0:0.11.3-4.el9_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::highavailability","package":"pcs-snmp","fixed_in":["0:0.11.3-4.el9_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"pcs","fixed_in":["0:0.11.3-4.el9_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"pcs-snmp","fixed_in":["0:0.11.3-4.el9_1.2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"pcs","fixed_in":["0:0.10.14-5.el8_7.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ruby-sinatra","fixed_in":["1.4.7-3ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby-sinatra","fixed_in":["1.4.8-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"ruby-sinatra","fixed_in":["2.0.8.1-2+deb11u1build0.22.04.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.0.4"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.2.3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.14-5.el8_7.2.alma"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.14-5.el8_7.2.alma"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.3-4.el9_1.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.3-4.el9_1.2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.8-1.el8.tuxcare.els2"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.8-1.el8.tuxcare.els2"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.8-1.el8.tuxcare.els2"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.8-1.el8.tuxcare.els2"}]}],"bundled":7},{"source":"osv","ecosystem":"Debian:12","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-2"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.5-4+deb10u2"}]}],"versions":["2.0.5-4","2.0.5-4+deb10u1"]},{"source":"osv","ecosystem":"Debian:11","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8.1-2+deb11u1"}]}],"versions":["2.0.8.1-2"],"bundled":2},{"source":"osv","ecosystem":"RubyGems","package":"sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.0.4"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3"]},{"source":"osv","ecosystem":"RubyGems","package":"sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.2.3"}]}],"versions":["2.0.0","2.0.1","2.0.1.rc1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.8.1","2.1.0","2.2.0","2.2.1","2.2.2"]},{"source":"osv","ecosystem":"Mageia:8","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8.1-1.2.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"rubygem-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8.1-3.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"rubygem-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8.1-4.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"rubygem-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8.1-3.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"rubygem-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8.1-3.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"rubygem-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-3.oe2003sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-6.el8_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-6.el8_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-6.el8_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-6.el8_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.12-6.el8_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.12-6.el8_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::resilientstorage","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.12-6.el8_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::resilientstorage","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.12-6.el8_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.8-1.el8_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.8-1.el8_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::resilientstorage","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.8-1.el8_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::resilientstorage","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.8-1.el8_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.1-10.el9_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.1-10.el9_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::resilientstorage","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.1-10.el9_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::resilientstorage","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.1-10.el9_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.14-5.el8_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.14-5.el8_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.14-5.el8_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.14-5.el8_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.2-4.el8_1.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.2-4.el8_1.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.3-4.el9_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.3-4.el9_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.3-4.el9_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.3-4.el9_1.2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.14-5.el8_7.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-3ubuntu0.1~esm2"}]}],"versions":["1.4.6-2","1.4.7-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8-1ubuntu0.1~esm2"}]}],"versions":["1.4.7-5","1.4.8-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8.1-2+deb11u1build0.22.04.1"}]}],"versions":["2.0.8.1-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-3ubuntu0.1~esm2"}]}],"versions":["1.4.6-2","1.4.7-3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8-1ubuntu0.1~esm2"}]}],"versions":["1.4.7-5","1.4.8-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8.1-1ubuntu0.1~esm2"}]}],"versions":["2.0.5-4ubuntu1","2.0.8.1-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8.1-2+deb11u1build0.22.04.1"}]}],"versions":["2.0.8.1-2"],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"sinatra","product":"sinatra"},{"vendor":"sinatrarb","product":"sinatra"}],"references":[{"url":"https://github.com/sinatra/sinatra/security/advisories/GHSA-2x8x-jmrp-phxw","tags":["x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/sinatra/sinatra/commit/ea8fc9495a350f7551b39e3025bfcd06f49f363b","tags":["x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/advisories/GHSA-8x94-hmjh-97hq","tags":["x_transferred","Not Applicable","advisory","report"]},{"url":"https://www.blackhat.com/docs/eu-14/materials/eu-14-Hafif-Reflected-File-Download-A-New-Web-Attack-Vector.pdf","tags":["x_transferred","Exploit","Third Party Advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/01/msg00005.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00020.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45442","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sinatra/CVE-2022-45442.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2x8x-jmrp-phxw"},{"url":"https://access.redhat.com/errata/RHSA-2023:0855","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-45442","tags":["report"]},{"url":"https://bugzilla.redhat.com/2153363","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-0855.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:0974","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-0974.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1790610952.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1049","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38900","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27530","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27539","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52804","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47287","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1790611274.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/45xxx/CVE-2022-45442.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-45442","tags":["advisory"]},{"url":"https://github.com/sinatra/sinatra","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2023-0029.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31416","tags":["report"]},{"url":"https://www.debian.org/lts/security/2023/dla-3264","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2474","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2475","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2476","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2477","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2490","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:0393","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2153363","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0393.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-45442","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2023:0427","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0427.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:0506","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0506.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:0527","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0527.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0855.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:0857","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0857.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0974.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:0855","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-45442","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7664-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-29970","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-45442","title":"Sinatra vulnerable to Reflected File Download attack","description":"Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.","status":"published","published":"2022-11-28T00:00:00Z","modified":"2025-11-04T16:09:56.861Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-494"],"updated_at":"2026-11-02T14:34:31.840191Z"}],"euvd":[{"id":"EUVD-2022-7200","description":"Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.","status":"published","published":"2022-11-28T00:00:00Z","modified":"2025-11-04T16:09:56Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:29.391161Z"}],"ghsa":[{"id":"GHSA-2x8x-jmrp-phxw","title":"Sinatra vulnerable to Reflected File Download attack","description":"### Description\nAn issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input.\n\n### References\n* https://www.blackhat.com/docs/eu-14/materials/eu-14-Hafif-Reflected-File-Download-A-New-Web-Attack-Vector.pdf\n* https://github.com/advisories/GHSA-8x94-hmjh-97hq","status":"published","published":"2022-11-30T21:18:34Z","modified":"2025-11-04T19:37:29Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-494"],"updated_at":"2026-11-02T14:39:06.376137Z"}],"nvd":[{"id":"CVE-2022-45442","description":"Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.","status":"published","published":"2022-11-28T21:15:10.67Z","modified":"2026-06-17T05:10:09.49Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-494"],"updated_at":"2026-11-02T14:07:32.827264Z"}],"osv":[{"id":"CVE-2022-45442","title":"Sinatra vulnerable to Reflected File Download attack","description":"Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.","status":"published","published":"2022-11-28T00:00:00Z","modified":"2026-10-28T02:31:15.064802965Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-494"],"updated_at":"2026-11-02T15:44:27.481647Z"},{"id":"GHSA-2x8x-jmrp-phxw","title":"Sinatra vulnerable to Reflected File Download attack","description":"### Description\nAn issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input.\n\n### References\n* https://www.blackhat.com/docs/eu-14/materials/eu-14-Hafif-Reflected-File-Download-A-New-Web-Attack-Vector.pdf\n* https://github.com/advisories/GHSA-8x94-hmjh-97hq","status":"published","published":"2022-11-30T21:18:34Z","modified":"2026-02-04T02:35:49.068446Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-494"],"updated_at":"2026-11-02T15:46:35.050232Z"},{"id":"OESA-2024-2474","title":"rubygem-sinatra security update","description":"Sinatra is a DSL intended for quickly creating web-applications in Ruby with minimal effort.\r\n\r\nSecurity Fix(es):\r\n\r\nSinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.(CVE-2022-45442)","status":"published","published":"2024-11-22T11:07:57Z","modified":"2026-08-18T01:18:41.47295408Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2475","title":"rubygem-sinatra security update","description":"Sinatra is a DSL intended for quickly creating web-applications in Ruby with minimal effort.\r\n\r\nSecurity Fix(es):\r\n\r\nSinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.(CVE-2022-45442)","status":"published","published":"2024-11-22T11:07:57Z","modified":"2026-08-18T01:18:41.509600113Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2476","title":"rubygem-sinatra security update","description":"Sinatra is a DSL intended for quickly creating web-applications in Ruby with minimal effort.\r\n\r\nSecurity Fix(es):\r\n\r\nSinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.(CVE-2022-45442)","status":"published","published":"2024-11-22T11:07:57Z","modified":"2026-08-18T01:18:41.576224115Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2477","title":"rubygem-sinatra security update","description":"Sinatra is a DSL intended for quickly creating web-applications in Ruby with minimal effort.\r\n\r\nSecurity Fix(es):\r\n\r\nSinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.(CVE-2022-45442)","status":"published","published":"2024-11-22T11:07:57Z","modified":"2026-08-18T01:18:41.55375777Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2490","title":"rubygem-sinatra security update","description":"Sinatra is a DSL intended for quickly creating web-applications in Ruby with minimal effort.\r\n\r\nSecurity Fix(es):\r\n\r\nSinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.(CVE-2022-45442)","status":"published","published":"2024-11-29T11:07:58Z","modified":"2026-08-18T01:18:41.572477817Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"RHSA-2023:0393","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2024-09-13T21:05:05Z","modified":"2026-06-29T10:45:38Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:0427","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2024-09-13T21:05:58Z","modified":"2026-06-29T10:45:41Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:0506","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2024-09-13T21:05:52Z","modified":"2026-06-29T10:45:46Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:0527","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2024-09-13T21:05:41Z","modified":"2026-06-29T10:45:47Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:0855","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2024-09-13T21:06:43Z","modified":"2026-06-29T10:46:05Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:0857","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2024-09-13T21:06:53Z","modified":"2026-06-29T10:46:06Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:0974","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2024-09-13T21:07:15Z","modified":"2026-06-29T10:46:12Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RLSA-2023:0855","title":"Moderate: pcs security update","description":"The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.\n\nSecurity Fix(es):\n\n* sinatra: Reflected File Download attack (CVE-2022-45442)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-02-22T01:08:55.795175Z","modified":"2026-02-05T00:45:06.895522Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2022-45442","description":"Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.","status":"published","published":"2022-11-28T21:15:00Z","modified":"2026-07-22T20:46:37.471526661Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:56.473586Z"},{"id":"ALSA-2023:0855","title":"Moderate: pcs security update","description":"The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.\n\nSecurity Fix(es):\n\n* sinatra: Reflected File Download attack (CVE-2022-45442)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-02-21T00:00:00Z","modified":"2026-10-29T11:01:35.550245436Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2023:0974","title":"Moderate: pcs security update","description":"The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.\n\nSecurity Fix(es):\n\n* sinatra: Reflected File Download attack (CVE-2022-45442)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-02-28T00:00:00Z","modified":"2026-10-29T11:31:24.186664002Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"CLSA-2026-1790610952","title":"pcs: Fix of 7 CVEs","description":"- CVE-2022-1049: fix pcsd PAM auth accepting expired accounts and passwords\n- CVE-2022-38900: fix DoS in decode() of bundled decode-uri-component\n- CVE-2022-45442: fix reflected file download in bundled sinatra attachment()\n- CVE-2023-27530: fix multipart part count DoS in rack (via rack 2.2.20)\n- CVE-2023-27539: fix ReDoS in rack header parsing (via rack 2.2.20)\n- CVE-2024-52804: fix quadratic cookie parsing in bundled tornado\n- CVE-2025-47287: fix multipart parser log flooding DoS in bundled tornado","status":"published","published":"2026-09-28T15:56:09Z","modified":"2026-10-26T09:31:44.061169655Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790611274","title":"pcs: Fix of 7 CVEs","description":"- CVE-2022-1049: fix pcsd PAM auth accepting expired accounts and passwords\n- CVE-2022-38900: fix DoS in decode() of bundled decode-uri-component\n- CVE-2022-45442: fix reflected file download in bundled sinatra attachment()\n- CVE-2023-27530: fix multipart part count DoS in rack (via rack 2.2.20)\n- CVE-2023-27539: fix ReDoS in rack header parsing (via rack 2.2.20)\n- CVE-2024-52804: fix quadratic cookie parsing in bundled tornado\n- CVE-2025-47287: fix multipart parser log flooding DoS in bundled tornado","status":"published","published":"2026-09-28T16:01:31Z","modified":"2026-10-26T09:31:51.368414759Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"DEBIAN-CVE-2022-45442","description":"Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.","status":"published","published":"2022-11-28T21:15:10.67Z","modified":"2026-11-03T06:03:01.103875726Z","updated_at":"2026-11-03T06:43:01.507088Z"},{"id":"DLA-3264-1","title":"ruby-sinatra - security update","status":"published","published":"2023-01-10T00:00:00Z","modified":"2026-03-09T01:22:37.165552Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DLA-3877-1","title":"ruby-sinatra - security update","status":"published","published":"2024-09-05T00:00:00Z","modified":"2026-03-09T01:21:08.532946Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2023-0029","title":"Updated ruby-sinatra packages fix security vulnerability","description":"Potential reflected file download (RFD) vulnerability in ruby-sinatra, a\nRuby library for writing HTTP applications. A Content-Disposition HTTP\nheader was being incorrectly derived from a potentially user-supplied\nfilename. (CVE-2022-45442)\n","status":"published","published":"2023-02-07T00:06:39Z","modified":"2026-04-16T04:44:40.53357995Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"USN-7664-1","title":"ruby-sinatra vulnerabilities","description":"It was discovered that Sinatra incorrectly handled serving static files.\nAn attacker could possibly use this issue to perform local file inclusion,\nobtaining sensitive information.\n(CVE-2022-29970)\n\nIt was discovered that Sinatra incorrectly handled special characters in\nthe Content-Disposition HTTP header. An attacker could possibly use this\nissue to perform a reflected file download attack, achieving remote code\nexecution. (CVE-2022-45442)","status":"published","published":"2025-07-22T12:17:53Z","modified":"2026-06-25T13:32:30.656145132Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}