CVE-2022-23633
Exposure of information in Action Pack
Impact
### Impact Under certain circumstances response bodies will not be closed, for example a [bug in a webserver](https://github.com/puma/puma/pull/2812) or a bug in a Rack middleware. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests, especially when interacting with `ActiveSupport::CurrentAttributes`. Upgrading to the FIXED versions of Rails will ensure mitigation of this issue even in the context of a buggy webserver or middleware implementation. ### Patches This has been fixed in Rails 7.0.2.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. ### Workarounds Upgrading is highly recommended, but to work around this problem the following middleware can be used: ```ruby class GuardedExecutor < ActionDispatch::Executor def call(env) ensure_completed! super end private def ensure_completed! @executor.new.complete! if @executor.active? end end # Ensure the guard is inserted before ActionDispatch::Executor Rails.application.configure do config.middleware.swap ActionDispatch::Executor, GuardedExecutor, executor end ```
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rubygems | actionpack | >= 5.0.0.0, <= 5.2.6.1 | 5.2.6.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rubyonrails | Rails | from 5.0.0 before 5.2.6.2 from 6.0.0 before 6.0.4.6 from 6.1.0 before 6.1.4.6 from 7.0.0 before 7.0.2.2 |
| Debian | Debian Linux | Versions 10.0, 11.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2022/02/11/5
- https://github.com/rails/rails/commit/f9a2ad03943d5c2ba54e1d45f155442b519c75da
- https://github.com/rails/rails/security/advisories/GHSA-wh98-p28r-vrc9
- https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html
- https://security.netapp.com/advisory/ntap-20240119-0013/
- https://www.debian.org/security/2023/dsa-5372
- https://github.com/advisories/GHSA-wh98-p28r-vrc9
- https://discuss.rubyonrails.org/t/cve-2022-23633-possible-exposure-of-information-vulnerability-in-action-pack/80016
- https://rubyonrails.org/2022/2/11/Rails-7-0-2-2-6-1-4-6-6-0-4-6-and-5-2-6-2-have-been-released
- https://nvd.nist.gov/vuln/detail/CVE-2022-23633
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2022-23633.yml
- https://groups.google.com/g/ruby-security-ann/c/FkTM-_7zSNA/m/K2RiMJBlBAAJ