ruby-rack: Rack provides an interface for developing web applications in Ruby

Rack provides an interface for developing web applications in Ruby. Priorto versions 2.2.13, 3.0.14, and 3.1.12, `Rack::Static` can serve filesunder the specified `root:` even if `urls:` are provided, which may exposeother files under the specified `root:` unexpectedly. The vulnerabilityoccurs because `Rack::Static` does not properly sanitize user-suppliedpaths before serving files. Specifically, encoded path traversal sequencesare not correctly validated, allowing attackers to access files outside thedesignated static file directory. By exploiting this vulnerability, anattacker can gain access to all files under the specified `root:`directory, provided they are able to determine then path of the file.Versions 2.2.13, 3.0.14, and 3.1.12 contain a patch for the issue. Othermitigations include removing usage of `Rack::Static`, or ensuring that`root:` points at a directory path which only contains files which shouldbe accessed publicly. It is likely that a CDN or similar static file serverwould also mitigate the issue.

Where it's fixed