Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.
CVSS Details
- CVSS 3.1 Base Score: 7.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-unf_extUpgrade tfm-rubygem-apipie-bindingsUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade rubygem-powerbarUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-highlineUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-fast_gettextUpgrade satellite-cloneUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-clampUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-rest-clientUpgrade tfm-rubygem-unfUpgrade rubygem-jwtUpgrade tfm-rubygem-little-pluggerUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-http-cookieUpgrade tfm-rubygem-unicode-debuginfoUpgrade rubygem-hammer_cliUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-unicodeUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-runtimeUpgrade rubygem-loggingUpgrade tfm-rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade foreman-cliUpgrade tfm-rubygem-loggingUpgrade rubygem-localeUpgrade rubygem-amazing_printUpgrade tfm-rubygem-amazing_printUpgrade tfm-rubygem-netrcUpgrade tfm-rubygem-unicodeUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_katelloUpgrade satellite-cliUpgrade rubygem-unicode-debuginfoUpgrade tfm-rubygem-multi_jsonUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-hashieUpgrade satellite-maintainUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-oauthUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-rest-clientUpgrade rubygem-multi_jsonUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-mime-typesUpgrade rubygem-foreman_maintainUpgrade rubygem-netrcUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-clampUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-domain_nameUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-localeUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-mime-types-dataUpgrade rubygem-little-pluggerUpgrade tfm-rubygem-highline | Jul 14, 2022 | Feb 11, 2022 |
| Debian | — | Upgrade rails | Sep 6, 2022 | Feb 11, 2022 |
| Redhat_linux | — | Upgrade tfm-rubygem-jwtUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-highlineUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade foreman-cliUpgrade rubygem-clampUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-netrcUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-jwtUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-domain_nameUpgrade rubygem-oauthUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-mime-types-dataUpgrade tfm-rubygem-hashieUpgrade rubygem-localeUpgrade tfm-rubygem-rest-clientUpgrade rubygem-hammer_cliUpgrade satellite-maintainUpgrade rubygem-fast_gettextUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-hashieUpgrade rubygem-rest-clientUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-foreman_maintainUpgrade tfm-rubygem-highlineUpgrade rubygem-mime-types-dataUpgrade rubygem-little-pluggerUpgrade satellite-cloneUpgrade rubygem-unf_extUpgrade tfm-rubygem-mime-typesUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-fast_gettextUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-loggingUpgrade tfm-rubygem-clampUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-powerbarUpgrade rubygem-multi_jsonUpgrade rubygem-netrcUpgrade tfm-rubygem-amazing_printUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unicodeUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-hammer_cliUpgrade satellite-cliUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-unicode-debugsourceUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-mime-typesUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-powerbarUpgrade rubygem-unfUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-unf_extUpgrade tfm-runtimeUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade rubygem-domain_nameUpgrade tfm-rubygem-loggingUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-apipie-bindingsUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-oauth | Jul 14, 2022 | Feb 11, 2022 |
| Rocky_linux | — | Upgrade libdb-sql-devel-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-debugsourceUpgrade libdb-cxxUpgrade libdb-debuginfo | Mar 12, 2024 | Feb 11, 2022 |
| Ruby_on_rails | — | Upgrade to the latest version of Ruby on Rails | Feb 24, 2022 | Feb 11, 2022 |
| Suse | — | Upgrade ruby2.5-rubygem-actionpack-doc-5_1Upgrade ruby2.5-rubygem-activesupport-5_1Upgrade ruby2.5-rubygem-actionpack-5_1Upgrade ruby2.5-rubygem-activesupport-doc-5_1 | Oct 26, 2022 | Feb 11, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub