Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.
CVSS Details
- CVSS 3.1 Base Score: 7.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-powerbarUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-highlineUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-rest-clientUpgrade rubygem-unicode-debugsourceUpgrade rubygem-jwtUpgrade tfm-rubygem-mime-types-dataUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-mime-typesUpgrade rubygem-fast_gettextUpgrade rubygem-oauthUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-runtimeUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-domain_nameUpgrade tfm-rubygem-amazing_printUpgrade rubygem-unf_extUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-hammer_cli_foremanUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-amazing_printUpgrade satellite-cloneUpgrade rubygem-unicodeUpgrade tfm-rubygem-unicode-debuginfoUpgrade rubygem-hammer_cliUpgrade rubygem-localeUpgrade rubygem-http-cookieUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-apipie-bindingsUpgrade rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-unfUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-clampUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-netrcUpgrade rubygem-clampUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-rest-clientUpgrade rubygem-multi_jsonUpgrade rubygem-mime-typesUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-mime-types-dataUpgrade rubygem-little-pluggerUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-hashieUpgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-domain_nameUpgrade tfm-rubygem-jwtUpgrade rubygem-foreman_maintainUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-hashieUpgrade tfm-rubygem-multi_jsonUpgrade satellite-maintainUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-localeUpgrade satellite-cliUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unfUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-unf_ext | Jul 14, 2022 | Feb 11, 2022 |
| Debian | — | Upgrade rails | Sep 6, 2022 | Feb 11, 2022 |
| Redhat_linux | — | Upgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-localeUpgrade foreman-cliUpgrade rubygem-clampUpgrade rubygem-highlineUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-foreman_maintainUpgrade tfm-rubygem-rest-clientUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-domain_nameUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-localeUpgrade rubygem-amazing_printUpgrade rubygem-oauthUpgrade rubygem-hammer_cliUpgrade rubygem-jwtUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade satellite-maintainUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-netrcUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hashieUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-hashieUpgrade rubygem-fast_gettextUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-loggingUpgrade rubygem-multi_jsonUpgrade tfm-runtimeUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade rubygem-domain_nameUpgrade satellite-cliUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-clampUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-powerbarUpgrade rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_openscapUpgrade satellite-cloneUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-amazing_printUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-fast_gettextUpgrade rubygem-http-cookieUpgrade tfm-rubygem-http-cookieUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-powerbarUpgrade rubygem-little-pluggerUpgrade rubygem-netrcUpgrade rubygem-unf_extUpgrade rubygem-mime-typesUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-unicodeUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-unf | Jul 14, 2022 | Feb 11, 2022 |
| Rocky_linux | — | Upgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-debuginfoUpgrade libdb-cxxUpgrade libdb-debugsource | Mar 12, 2024 | Feb 11, 2022 |
| Ruby_on_rails | — | Upgrade to the latest version of Ruby on Rails | Feb 24, 2022 | Feb 11, 2022 |
| Suse | — | Upgrade ruby2.5-rubygem-actionpack-5_1Upgrade ruby2.5-rubygem-activesupport-doc-5_1Upgrade ruby2.5-rubygem-actionpack-doc-5_1Upgrade ruby2.5-rubygem-activesupport-5_1 | Oct 26, 2022 | Feb 11, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub