Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-clampUpgrade rubygem-unicode-display_widthUpgrade rubygem-little-pluggerUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-mime-typesUpgrade tfm-rubygem-unicodeUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-unf_extUpgrade rubygem-unicode-debuginfoUpgrade tfm-rubygem-localeUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-oauthUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-hammer_cliUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-http-cookieUpgrade satellite-cliUpgrade tfm-rubygem-netrcUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unfUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-amazing_printUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-rest-clientUpgrade rubygem-unicode-debugsourceUpgrade tfm-rubygem-mime-typesUpgrade rubygem-jwtUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-runtimeUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-domain_nameUpgrade tfm-rubygem-fast_gettextUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cliUpgrade tfm-rubygem-unicode-debuginfoUpgrade rubygem-powerbarUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-amazing_printUpgrade tfm-rubygem-apipie-bindingsUpgrade tfm-rubygem-hammer_cli_katelloUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-unfUpgrade rubygem-http-cookieUpgrade rubygem-localeUpgrade tfm-rubygem-mime-types-dataUpgrade satellite-cloneUpgrade rubygem-fast_gettextUpgrade rubygem-oauthUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-clampUpgrade rubygem-unicodeUpgrade foreman-cliUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-highlineUpgrade rubygem-mime-types-dataUpgrade satellite-maintainUpgrade rubygem-hashieUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-multi_jsonUpgrade tfm-rubygem-rest-clientUpgrade tfm-rubygem-domain_name | Jul 14, 2022 | Feb 11, 2022 |
| Debian | — | Upgrade rails | Sep 6, 2022 | Feb 11, 2022 |
| Redhat_linux | — | Upgrade tfm-rubygem-mime-types-dataUpgrade rubygem-unicode-debuginfoUpgrade rubygem-highlineUpgrade rubygem-localeUpgrade rubygem-hashieUpgrade rubygem-rest-clientUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-domain_nameUpgrade rubygem-oauthUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cliUpgrade rubygem-clampUpgrade tfm-rubygem-multi_jsonUpgrade tfm-rubygem-hashieUpgrade rubygem-fast_gettextUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-rest-clientUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-foreman_maintainUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-netrcUpgrade satellite-maintainUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-unicodeUpgrade foreman-cliUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-unfUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-oauthUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade satellite-cliUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade rubygem-multi_jsonUpgrade rubygem-unicodeUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unicode-display_widthUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-loggingUpgrade rubygem-mime-typesUpgrade tfm-runtimeUpgrade rubygem-domain_nameUpgrade tfm-rubygem-hammer_cliUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-powerbarUpgrade tfm-rubygem-amazing_printUpgrade tfm-rubygem-clampUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-fast_gettextUpgrade rubygem-http-cookieUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-little-pluggerUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-unfUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-netrcUpgrade rubygem-unf_extUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade satellite-cloneUpgrade tfm-rubygem-powerbar | Jul 14, 2022 | Feb 11, 2022 |
| Rocky_linux | — | Upgrade libdb-cxxUpgrade libdb-debugsourceUpgrade libdb-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-cxx-debuginfo | Mar 12, 2024 | Feb 11, 2022 |
| Ruby_on_rails | — | Upgrade to the latest version of Ruby on Rails | Feb 24, 2022 | Feb 11, 2022 |
| Suse | — | Upgrade ruby2.5-rubygem-actionpack-doc-5_1Upgrade ruby2.5-rubygem-activesupport-5_1Upgrade ruby2.5-rubygem-actionpack-5_1Upgrade ruby2.5-rubygem-activesupport-doc-5_1 | Oct 26, 2022 | Feb 11, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub