CVE-2024-21510

Name	CVE-2024-21510
Description	Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host (XFH) header. When making a request to a method with redirect applied, it is possible to trigger an Open Redirect Attack by inserting an arbitrary address into this header. If used for caching purposes, such as with servers like Nginx, or as a reverse proxy, without handling the X-Forwarded-Host header, attackers can potentially exploit Cache Poisoning or Routing-based SSRF.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1087290

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
ruby-sinatra (PTS)	jessie	1.4.5-1	vulnerable
	stretch (lts), stretch	1.4.7-5+deb9u2	vulnerable
	buster (security), buster, buster (lts)	2.0.5-4+deb10u2	vulnerable
	bullseye	2.0.8.1-2	vulnerable
	bullseye (security)	2.0.8.1-2+deb11u1	vulnerable
	bookworm	3.0.5-3	vulnerable
	sid, trixie	3.2.0-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
ruby-sinatra	source	jessie	(unfixed)	end-of-life
ruby-sinatra	source	(unstable)	(unfixed)			1087290

Notes

[bookworm] - ruby-sinatra <ignored> (Minor issue, too intrusive to backport)
https://security.snyk.io/vuln/SNYK-RUBY-SINATRA-6483832
https://github.com/sinatra/sinatra/pull/2053
Rejected upstream fix: https://github.com/sinatra/sinatra/pull/2010