{"schema_version":"1.7.3","id":"GHSA-wh98-p28r-vrc9","published":"2022-02-11T20:49:14Z","modified":"2026-02-04T04:00:06.851323Z","aliases":["CVE-2022-23633"],"related":["CVE-2022-23634"],"summary":"Exposure of information in Action Pack","details":"### Impact\n\nUnder certain circumstances response bodies will not be closed, for example a [bug in a webserver](https://github.com/puma/puma/pull/2812) or a bug in a Rack middleware.  In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request.  This can lead to data being leaked to subsequent requests, especially when interacting with `ActiveSupport::CurrentAttributes`.\n\nUpgrading to the FIXED versions of Rails will ensure mitigation of this issue even in the context of a buggy webserver or middleware implementation.\n\n### Patches\n\nThis has been fixed in Rails 7.0.2.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2.\n\n### Workarounds\n\nUpgrading is highly recommended, but to work around this problem the following middleware can be used:\n\n```ruby\nclass GuardedExecutor < ActionDispatch::Executor\n  def call(env)\n    ensure_completed!\n    super\n  end\n\n  private\n\n    def ensure_completed!\n      @executor.new.complete! if @executor.active?\n    end\nend\n\n# Ensure the guard is inserted before ActionDispatch::Executor\nRails.application.configure do\n  config.middleware.swap ActionDispatch::Executor, GuardedExecutor, executor\nend\n```","affected":[{"package":{"name":"actionpack","ecosystem":"RubyGems","purl":"pkg:gem/actionpack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0.0"},{"fixed":"5.2.6.2"}]}],"versions":["5.0.0","5.0.0.1","5.0.1","5.0.1.rc1","5.0.1.rc2","5.0.2","5.0.2.rc1","5.0.3","5.0.4","5.0.4.rc1","5.0.5","5.0.5.rc1","5.0.5.rc2","5.0.6","5.0.6.rc1","5.0.7","5.0.7.1","5.0.7.2","5.1.0","5.1.0.beta1","5.1.0.rc1","5.1.0.rc2","5.1.1","5.1.2","5.1.2.rc1","5.1.3","5.1.3.rc1","5.1.3.rc2","5.1.3.rc3","5.1.4","5.1.4.rc1","5.1.5","5.1.5.rc1","5.1.6","5.1.6.1","5.1.6.2","5.1.7","5.1.7.rc1","5.2.0","5.2.0.beta1","5.2.0.beta2","5.2.0.rc1","5.2.0.rc2","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.3","5.2.4.4","5.2.4.5","5.2.4.6","5.2.4.rc1","5.2.5","5.2.6","5.2.6.1"],"database_specific":{"last_known_affected_version_range":"<= 5.2.6.1","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-wh98-p28r-vrc9/GHSA-wh98-p28r-vrc9.json"}},{"package":{"name":"actionpack","ecosystem":"RubyGems","purl":"pkg:gem/actionpack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0.0"},{"fixed":"6.0.4.6"}]}],"versions":["6.0.0","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5"],"database_specific":{"last_known_affected_version_range":"<= 6.0.4.5","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-wh98-p28r-vrc9/GHSA-wh98-p28r-vrc9.json"}},{"package":{"name":"actionpack","ecosystem":"RubyGems","purl":"pkg:gem/actionpack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0.0"},{"fixed":"6.1.4.6"}]}],"versions":["6.1.0","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5"],"database_specific":{"last_known_affected_version_range":"<= 6.1.4.5","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-wh98-p28r-vrc9/GHSA-wh98-p28r-vrc9.json"}},{"package":{"name":"actionpack","ecosystem":"RubyGems","purl":"pkg:gem/actionpack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0.0"},{"fixed":"7.0.2.2"}]}],"versions":["7.0.0","7.0.1","7.0.2","7.0.2.1"],"database_specific":{"last_known_affected_version_range":"<= 7.0.2.1","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-wh98-p28r-vrc9/GHSA-wh98-p28r-vrc9.json"}}],"references":[{"type":"WEB","url":"https://github.com/rails/rails/security/advisories/GHSA-wh98-p28r-vrc9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23633"},{"type":"WEB","url":"https://github.com/rails/rails/commit/f9a2ad03943d5c2ba54e1d45f155442b519c75da"},{"type":"WEB","url":"https://discuss.rubyonrails.org/t/cve-2022-23633-possible-exposure-of-information-vulnerability-in-action-pack/80016"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2022-23633.yml"},{"type":"WEB","url":"https://groups.google.com/g/ruby-security-ann/c/FkTM-_7zSNA/m/K2RiMJBlBAAJ"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html"},{"type":"WEB","url":"https://rubyonrails.org/2022/2/11/Rails-7-0-2-2-6-1-4-6-6-0-4-6-and-5-2-6-2-have-been-released"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20240119-0013"},{"type":"WEB","url":"https://www.debian.org/security/2023/dsa-5372"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2022/02/11/5"}],"database_specific":{"cwe_ids":["CWE-200","CWE-212"],"github_reviewed":true,"github_reviewed_at":"2022-02-11T20:49:14Z","nvd_published_at":"2022-02-11T21:15:00Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}]}