CVE-2022-23633: Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response…

PriorityP432medium5.9CVSS 3.1

AVNACHPRNUINSUCHINAN

EPSS

2.23%

80.7th percentile

Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.

Affected

21 ranges

Vendor	Product	Version range	Fixed in
actionpack_project	actionpack	>= 5.0.0.0 < 5.2.6.2	5.2.6.2
actionpack_project	actionpack	>= 6.0.0.0 < 6.0.4.6	6.0.4.6
actionpack_project	actionpack	>= 6.1.0.0 < 6.1.4.6	6.1.4.6
actionpack_project	actionpack	>= 7.0.0.0 < 7.0.2.2	7.0.2.2
debian	debian_linux	—	—
debian	debian_linux	—	—
debian	rails	< rails 2:6.1.4.6+dfsg-1 (bookworm)	rails 2:6.1.4.6+dfsg-1 (bookworm)
puma	puma	>= 0 < 4.3.11	4.3.11
puma	puma	>= 5.0.0 < 5.6.2	5.6.2
rails	rails	—	—
rails	rails	—	—
rails	rails	—	—
rails	rails	—	—
rubyonrails	rails	>= 0 < 2:6.0.3.7+dfsg-2+deb11u1	2:6.0.3.7+dfsg-2+deb11u1
rubyonrails	rails	>= 0 < 2:6.1.4.6+dfsg-1	2:6.1.4.6+dfsg-1
rubyonrails	rails	>= 0 < 2:6.1.4.6+dfsg-1	2:6.1.4.6+dfsg-1
rubyonrails	rails	>= 0 < 2:6.1.4.6+dfsg-1	2:6.1.4.6+dfsg-1
rubyonrails	rails	>= 5.0.0 < 5.2.6.2	5.2.6.2
rubyonrails	rails	>= 6.0.0 < 6.0.4.6	6.0.4.6
rubyonrails	rails	>= 6.1.0 < 6.1.4.6	6.1.4.6
rubyonrails	rails	>= 7.0.0 < 7.0.2.2	7.0.2.2

CVSS provenance

nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N

ghsa5.9MEDIUM

osv5.9MEDIUM

vendor_debian7.4HIGH

vendor_redhat7.4HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.