CVE-2022-23633

Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.

Affected products

Alt Linux, Action Pack, Actiondispatch::Executor, Activesupport::Currentattributes, Astra Linux, Puma, Rails, Rocky Linux

Rubyonrails Rails

< 5.2.6.2, 6.0.4.6, 6.1.4.6, 7.0.2.2

Fix

Available

CVSS 3.1

7.4 HIGH

EPSS

2.2% (81th percentile)

Weakness

CWE-200, CWE-212

NVD status

Modified

Published

2022-02-11

No exploit for CVE-2022-23633 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.