CVE-2022-23633: Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response…

medium5.9CVSS 3.1

AVNACHPRNUINSUCHINAN

Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.

Affected

21 ranges

Vendor	Product	Version range	Fixed in
actionpack_project	actionpack	>= 5.0.0.0 < 5.2.6.2	5.2.6.2
actionpack_project	actionpack	>= 6.0.0.0 < 6.0.4.6	6.0.4.6
actionpack_project	actionpack	>= 6.1.0.0 < 6.1.4.6	6.1.4.6
actionpack_project	actionpack	>= 7.0.0.0 < 7.0.2.2	7.0.2.2
debian	debian_linux	—	—
debian	debian_linux	—	—
debian	rails	< rails 2:6.1.4.6+dfsg-1 (bookworm)	rails 2:6.1.4.6+dfsg-1 (bookworm)
puma	puma	>= 0 < 4.3.11	4.3.11
puma	puma	>= 5.0.0 < 5.6.2	5.6.2
rails	rails	—	—
rails	rails	—	—
rails	rails	—	—
rails	rails	—	—
rubyonrails	rails	>= 0 < 2:6.0.3.7+dfsg-2+deb11u1	2:6.0.3.7+dfsg-2+deb11u1
rubyonrails	rails	>= 0 < 2:6.1.4.6+dfsg-1	2:6.1.4.6+dfsg-1
rubyonrails	rails	>= 0 < 2:6.1.4.6+dfsg-1	2:6.1.4.6+dfsg-1
rubyonrails	rails	>= 0 < 2:6.1.4.6+dfsg-1	2:6.1.4.6+dfsg-1
rubyonrails	rails	>= 5.0.0 < 5.2.6.2	5.2.6.2
rubyonrails	rails	>= 6.0.0 < 6.0.4.6	6.0.4.6
rubyonrails	rails	>= 6.1.0 < 6.1.4.6	6.1.4.6
rubyonrails	rails	>= 7.0.0 < 7.0.2.2	7.0.2.2

CVSS provenance

nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

ghsa5.9MEDIUM

osv5.9MEDIUM