What’s Vulnerable › Vulnerabilities
CVE-2022-23633: Exposure of sensitive information in Action Pack
- Severity: medium (CVSS 5.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 2.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2022-02-11 · updated 2026-06-17
- Weakness: CWE-200
Description
Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.
Affected products
- Debian Linux: 10.0, 11.0
- Ruby on Rails: from 5.0.0 before 5.2.6.2; from 6.0.0 before 6.0.4.6; from 6.1.0 before 6.1.4.6; from 7.0.0 before 7.0.2.2 — fixed in 5.2.6.2, 6.0.4.6, 6.1.4.6, 7.0.2.2
- Rubygems Actionpack: from 5.0.0.0 before 5.2.6.2; from 6.0.0.0 before 6.0.4.6; from 6.1.0.0 before 6.1.4.6; from 7.0.0.0 before 7.0.2.2; 5.0.0, 5.0.0.1, 5.0.1, 5.0.1.rc1, 5.0.1.rc2, 5.0.2 (+96) — fixed in 5.2.6.2, 6.0.4.6, 6.1.4.6, 7.0.2.2
How to fix
Upgrade to a fixed version: Ruby on Rails 5.2.6.2, 6.0.4.6, 6.1.4.6, 7.0.2.2; Rubygems Actionpack 5.2.6.2, 6.0.4.6, 6.1.4.6, 7.0.2.2. Check the vendor advisory for mitigations.
References
- http://www.openwall.com/lists/oss-security/2022/02/11/5
- https://github.com/rails/rails/commit/f9a2ad03943d5c2ba54e1d45f155442b519c75da
- https://github.com/rails/rails/security/advisories/GHSA-wh98-p28r-vrc9
- https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html
- https://security.netapp.com/advisory/ntap-20240119-0013/
- https://www.debian.org/security/2023/dsa-5372
- http://www.openwall.com/lists/oss-security/2022/02/11/5
- https://github.com/rails/rails/commit/f9a2ad03943d5c2ba54e1d45f155442b519c75da
- https://github.com/rails/rails/security/advisories/GHSA-wh98-p28r-vrc9
- https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html
- https://security.netapp.com/advisory/ntap-20240119-0013/
- https://www.debian.org/security/2023/dsa-5372
Get alerted when CVE-2022-23633 or the next vulnerability affects your stack