Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.
CVSS Details
- CVSS 3.1 Base Score: 7.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-http-cookieUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-clampUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-oauthUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hashieUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade satellite-cliUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade satellite-maintainUpgrade tfm-rubygem-domain_nameUpgrade rubygem-unfUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-netrcUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-highlineUpgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-hashieUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-multi_jsonUpgrade tfm-rubygem-unicodeUpgrade rubygem-unicode-debuginfoUpgrade rubygem-little-pluggerUpgrade tfm-rubygem-rest-clientUpgrade rubygem-mime-types-dataUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-little-pluggerUpgrade rubygem-jwtUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-clampUpgrade rubygem-unicodeUpgrade rubygem-rest-clientUpgrade rubygem-amazing_printUpgrade foreman-cliUpgrade tfm-rubygem-loggingUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-powerbarUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-mime-types-dataUpgrade satellite-cloneUpgrade rubygem-fast_gettextUpgrade tfm-rubygem-amazing_printUpgrade rubygem-unf_extUpgrade rubygem-domain_nameUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cliUpgrade rubygem-localeUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-runtimeUpgrade rubygem-unicode-debugsource | Jul 14, 2022 | Feb 11, 2022 |
| Debian | — | Upgrade rails | Sep 6, 2022 | Feb 11, 2022 |
| Redhat_linux | — | Upgrade tfm-rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-mime-typesUpgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unfUpgrade rubygem-unicodeUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-fast_gettextUpgrade satellite-cliUpgrade tfm-rubygem-powerbarUpgrade rubygem-http-cookieUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-clampUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-loggingUpgrade rubygem-domain_nameUpgrade tfm-rubygem-hammer_cli_katelloUpgrade tfm-runtimeUpgrade satellite-cloneUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-mime-typesUpgrade rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-amazing_printUpgrade rubygem-powerbarUpgrade rubygem-little-pluggerUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-unicode-debugsourceUpgrade tfm-rubygem-apipie-bindingsUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-unfUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unf_extUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-multi_jsonUpgrade tfm-rubygem-domain_nameUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-netrcUpgrade satellite-maintainUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-oauthUpgrade rubygem-amazing_printUpgrade tfm-rubygem-jwtUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-foreman_maintainUpgrade foreman-cliUpgrade rubygem-fast_gettextUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-rest-clientUpgrade tfm-rubygem-hashieUpgrade rubygem-clampUpgrade tfm-rubygem-mime-types-dataUpgrade tfm-rubygem-localeUpgrade rubygem-highlineUpgrade rubygem-hashieUpgrade rubygem-rest-clientUpgrade rubygem-unicode-debuginfoUpgrade tfm-rubygem-highlineUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-localeUpgrade rubygem-jwt | Jul 14, 2022 | Feb 11, 2022 |
| Rocky_linux | — | Upgrade libdb-sql-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-debuginfoUpgrade libdb-debugsourceUpgrade libdb-cxx | Mar 12, 2024 | Feb 11, 2022 |
| Ruby_on_rails | — | Upgrade to the latest version of Ruby on Rails | Feb 24, 2022 | Feb 11, 2022 |
| Suse | — | Upgrade ruby2.5-rubygem-actionpack-doc-5_1Upgrade ruby2.5-rubygem-activesupport-5_1Upgrade ruby2.5-rubygem-activesupport-doc-5_1Upgrade ruby2.5-rubygem-actionpack-5_1 | Oct 26, 2022 | Feb 11, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub