Vulnerability · Published Feb 11, 2022 · Assigned by GitHub_M
CVE-2022-23633Exposure of sensitive information in Action Pack
High 7.4
In plain English
A high-severity information exposure in rails from rails. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | rails | 2:6.1.4.6+dfsg-1 | DEBIAN-CVE-2022-23633 |
| Debian:13 | rails | 2:6.1.4.6+dfsg-1 | DEBIAN-CVE-2022-23633 |
| Debian:14 | rails | 2:6.1.4.6+dfsg-1 | DEBIAN-CVE-2022-23633 |
| Rocky Linux:8 | libdb | 0:5.3.28-42.el8_4 | RLSA-2022:5498 |
| RubyGems | actionpack | 7.0.2.2 | GHSA-wh98-p28r-vrc9 |
| RubyGems | actionpack | 6.1.4.6 | GHSA-wh98-p28r-vrc9 |
| RubyGems | actionpack | 6.0.4.6 | GHSA-wh98-p28r-vrc9 |
| RubyGems | actionpack | 5.2.6.2 | GHSA-wh98-p28r-vrc9 |
| Ubuntu:24.04:LTS | rails | no fix listed | UBUNTU-CVE-2022-23633 |
| Ubuntu:25.10 | rails | no fix listed | UBUNTU-CVE-2022-23633 |
| Ubuntu:26.04:LTS | rails | no fix listed | UBUNTU-CVE-2022-23633 |
| Ubuntu:26.10 | rails | no fix listed | UBUNTU-CVE-2022-23633 |
Affected products (as reported)
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- https://github.com/rails/rails/security/advisories/GHSA-wh98-p28r-vrc9
- https://github.com/rails/rails/commit/f9a2ad03943d5c2ba54e1d45f155442b519c75da
- [oss-security] 20220211 [CVE-2022-23633] Possible exposure of information vulnerability in Action Pack mailing-list
- [debian-lts-announce] 20220903 [SECURITY] [DLA 3093-1] rails security update mailing-list
- DSA-5372 vendor-advisory
- https://security.netapp.com/advisory/ntap-20240119-0013/