Vulnerability advisory
CVE-2022-23633
Exposure of sensitive information in Action Pack
Also known as GHSA-wh98-p28r-vrc9
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/rails/rails ↗ | |
| 2efddadd6cba4e2129acedf1d402d11abcc03996 to before 46fe51b4875ba947cd3317cef420042f22aa8ffd | 46fe51b4875ba947cd3317cef420042f22aa8ffd |
| 66cabeda2c46c582d19738e1318be8d59584cc5b to before 5f85a37f49227a76ec472eb74954b54806028641 | 5f85a37f49227a76ec472eb74954b54806028641 |
| 914caca2d31bd753f47f9168f2a375921d9e91cc to before 10a2c77e901eb15b486f2c72fd9997bd0e2d506c | 10a2c77e901eb15b486f2c72fd9997bd0e2d506c |
| 984c3ef2775781d47efa9f541ce570daa2434a80 to before 2459c20afb508c987347f52148210d874a9af4fa | 2459c20afb508c987347f52148210d874a9af4fa |
| Not specified | f9a2ad03943d5c2ba54e1d45f155442b519c75da |
Also listed as affected (21)
| |
Description
Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is not notified of a close, ActionDispatch::Executor will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.
References
- Advisorygithub.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23633.json ↗
- Advisorygithub.com/rails/rails/security/advisories/GHSA-wh98-p28r-vrc9 ↗
- Advisorynvd.nist.gov/vuln/detail/CVE-2022-23633 ↗
- Advisorysecurity.netapp.com/advisory/ntap-20240119-0013/ ↗
- Advisorywww.debian.org/security/2023/dsa-5372 ↗
- Fixgithub.com/rails/rails/commit/f9a2ad03943d5c2ba54e1d45f155442b519c75da ↗
- ARTICLEwww.openwall.com/lists/oss-security/2022/02/11/5 ↗
- ARTICLElists.debian.org/debian-lts-announce/2022/09/msg00002.html ↗