VYPR
← All advisories
High severityNVD Advisory· Published Feb 11, 2022· Updated Aug 3, 2024

Exposure of sensitive information in Action Pack

CVE-2022-23633

Description

Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a close, ActionDispatch::Executor will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
actionpackRubyGems
>= 5.0.0.0, < 5.2.6.25.2.6.2
actionpackRubyGems
>= 6.0.0.0, < 6.0.4.66.0.4.6
actionpackRubyGems
>= 6.1.0.0, < 6.1.4.66.1.4.6
actionpackRubyGems
>= 7.0.0.0, < 7.0.2.27.0.2.2

Affected products

1

Patches

1
f9a2ad03943d

Fix reloader to work with new Executor signature

https://github.com/rails/railsAaron PattersonFeb 11, 2022via ghsa
commit
1 file changed · +1 −1
  • activesupport/lib/active_support/reloader.rb+1 −1 modified
    @@ -58,7 +58,7 @@ def self.reload!
       prepare!
     end
 
-    def self.run! # :nodoc:
+    def self.run!(reset: false) # :nodoc:
       if check!
         super
       else

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

13

News mentions

0

No linked articles in our index yet.