{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-23633", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "dateUpdated": "2024-08-03T03:51:44.739Z", "dateReserved": "2022-01-19T00:00:00", "datePublished": "2022-02-11T00:00:00"}, "containers": {"cna": {"title": "Exposure of sensitive information in Action Pack", "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-01-19T16:06:28.821144"}, "descriptions": [{"lang": "en", "value": "Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used."}], "affected": [{"vendor": "rails", "product": "rails", "versions": [{"version": ">= 7.0.0.0, < 7.0.2.1", "status": "affected"}, {"version": ">= 6.1.0.0, < 6.1.4.5", "status": "affected"}, {"version": ">= 6.0.0.0, < 6.0.4.5", "status": "affected"}, {"version": ">= 5.0.0, < 5.2.6.1", "status": "affected"}]}], "references": [{"url": "https://github.com/rails/rails/security/advisories/GHSA-wh98-p28r-vrc9"}, {"url": "https://github.com/rails/rails/commit/f9a2ad03943d5c2ba54e1d45f155442b519c75da"}, {"name": "[oss-security] 20220211 [CVE-2022-23633] Possible exposure of information vulnerability in Action Pack", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2022/02/11/5"}, {"name": "[debian-lts-announce] 20220903 [SECURITY] [DLA 3093-1] rails security update", "tags": ["mailing-list"], "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html"}, {"name": "DSA-5372", "tags": ["vendor-advisory"], "url": "https://www.debian.org/security/2023/dsa-5372"}, {"url": "https://security.netapp.com/advisory/ntap-20240119-0013/"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "cweId": "CWE-200"}]}], "source": {"advisory": "GHSA-wh98-p28r-vrc9", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T03:51:44.739Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/rails/rails/security/advisories/GHSA-wh98-p28r-vrc9", "tags": ["x_transferred"]}, {"url": "https://github.com/rails/rails/commit/f9a2ad03943d5c2ba54e1d45f155442b519c75da", "tags": ["x_transferred"]}, {"name": "[oss-security] 20220211 [CVE-2022-23633] Possible exposure of information vulnerability in Action Pack", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2022/02/11/5"}, {"name": "[debian-lts-announce] 20220903 [SECURITY] [DLA 3093-1] rails security update", "tags": ["mailing-list", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html"}, {"name": "DSA-5372", "tags": ["vendor-advisory", "x_transferred"], "url": "https://www.debian.org/security/2023/dsa-5372"}, {"url": "https://security.netapp.com/advisory/ntap-20240119-0013/", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*", "matchCriteriaId": "799C8F9A-10DD-4840-AAB5-F444DDA46FE2", "versionEndExcluding": "5.2.6.2", "versionStartIncluding": "5.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*", "matchCriteriaId": "CB7B860B-0F93-4C93-8C95-29D259A38C43", "versionEndExcluding": "6.0.4.6", "versionStartIncluding": "6.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*", "matchCriteriaId": "A8FC3F82-3521-470B-910E-395895BAB248", "versionEndExcluding": "6.1.4.6", "versionStartIncluding": "6.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*", "matchCriteriaId": "AC6C96FF-285D-4378-86FF-AFB70FC339A3", "versionEndExcluding": "7.0.2.2", "versionStartIncluding": "7.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used."}, {"lang": "es", "value": "Action Pack es un marco de trabajo para manejar y responder a peticiones web. Bajo determinadas circunstancias los cuerpos de las respuestas no son cerradas. En el caso de que una respuesta *no* sea notificada de un \"close\", \"ActionDispatch::Executor\" no sabr\u00e1 restablecer el estado local del hilo para la siguiente petici\u00f3n. Esto puede conllevar a que sean filtrados datos a las siguientes peticiones. Esto ha sido corregido en Rails versiones 7.0.2.1, 6.1.4.5, 6.0.4.5 y 5.2.6.1. Es recomendado encarecidamente actualizar, pero para mitigar este problema puede usarse el middleware descrito en GHSA-wh98-p28r-vrc9"}], "id": "CVE-2022-23633", "lastModified": "2024-01-19T16:15:08.417", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2022-02-11T21:15:11.990", "references": [{"source": "security-advisories@github.com", "tags": ["Mailing List", "Mitigation", "Patch", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/02/11/5"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/rails/rails/commit/f9a2ad03943d5c2ba54e1d45f155442b519c75da"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Third Party Advisory"], "url": "https://github.com/rails/rails/security/advisories/GHSA-wh98-p28r-vrc9"}, {"source": "security-advisories@github.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html"}, {"source": "security-advisories@github.com", "url": "https://security.netapp.com/advisory/ntap-20240119-0013/"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://www.debian.org/security/2023/dsa-5372"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-212"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-200"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2022:5498", "cpe": "cpe:/a:redhat:satellite:6.11::el7", "package": "tfm-rubygem-actionpack-0:6.0.4.7-1.el7sat", "product_name": "Red Hat Satellite 6.11 for RHEL 7", "release_date": "2022-07-05T00:00:00Z"}, {"advisory": "RHSA-2022:5498", "cpe": "cpe:/a:redhat:satellite:6.11::el8", "package": "rubygem-actionpack-0:6.0.4.7-1.el8sat", "product_name": "Red Hat Satellite 6.11 for RHEL 8", "release_date": "2022-07-05T00:00:00Z"}], "bugzilla": {"description": "rubygem-actionpack: information leak between requests", "id": "2063149", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2063149"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "verified"}, "cwe": "CWE-212", "details": ["Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.", "A flaw was found in the Rack middleware package of RubyGems, where response bodies will not close under certain circumstances. This flaw allows an attacker to iterate requests to force ActionDispatch::Executor to not close, allowing subsequent requests to leak data from ActiveSupport::CurrentAttributes."], "mitigation": {"lang": "en:us", "value": "A workaround for this problem:\n~~~\nclass GuardedExecutor < ActionDispatch::Executor\ndef call(env)\nensure_completed!\nsuper\nend\nprivate\ndef ensure_completed!\n@executor.new.complete! if @executor.active?\nend\nend\n# Ensure the guard is inserted before ActionDispatch::Executor\nRails.application.configure do\nconfig.middleware.swap ActionDispatch::Executor, GuardedExecutor, executor\nend\n~~~"}, "name": "CVE-2022-23633", "public_date": "2022-02-11T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-23633\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-23633\nhttps://github.com/rails/rails/security/advisories/GHSA-wh98-p28r-vrc9"], "threat_severity": "Moderate", "upstream_fix": "rails 7.0.2.1, rails 6.1.4.5, rails 6.0.4.5, rails 5.2.6.1"}