Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.
CVSS Details
- CVSS 3.1 Base Score: 7.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-hammer_cli_foreman_adminUpgrade satellite-cliUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unfUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-netrcUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-hashieUpgrade rubygem-unicode-display_widthUpgrade rubygem-mime-types-dataUpgrade rubygem-little-pluggerUpgrade rubygem-hashieUpgrade tfm-rubygem-multi_jsonUpgrade satellite-maintainUpgrade tfm-rubygem-domain_nameUpgrade tfm-rubygem-rest-clientUpgrade rubygem-multi_jsonUpgrade rubygem-mime-typesUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-clampUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-localeUpgrade rubygem-localeUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-http-cookieUpgrade rubygem-amazing_printUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-unicode-debuginfoUpgrade rubygem-hammer_cliUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade foreman-cliUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-loggingUpgrade tfm-runtimeUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade satellite-cloneUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-unf_extUpgrade rubygem-loggingUpgrade rubygem-powerbarUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-fast_gettextUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-unicodeUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-apipie-bindingsUpgrade rubygem-jwtUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-amazing_printUpgrade rubygem-oauthUpgrade tfm-rubygem-clampUpgrade rubygem-rest-clientUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-unicode-debugsourceUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_bootdisk | Jul 14, 2022 | Feb 11, 2022 |
| Debian | — | Upgrade rails | Sep 6, 2022 | Feb 11, 2022 |
| Redhat_linux | — | Upgrade rubygem-highlineUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-mime-types-dataUpgrade rubygem-fast_gettextUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-rest-clientUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-netrcUpgrade satellite-maintainUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-foreman_maintainUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hashieUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cliUpgrade tfm-rubygem-highlineUpgrade rubygem-amazing_printUpgrade rubygem-oauthUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-localeUpgrade tfm-rubygem-domain_nameUpgrade rubygem-jwtUpgrade tfm-rubygem-unicode-debuginfoUpgrade rubygem-clampUpgrade foreman-cliUpgrade tfm-rubygem-localeUpgrade rubygem-http-cookieUpgrade rubygem-loggingUpgrade rubygem-unf_extUpgrade tfm-rubygem-amazing_printUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-powerbarUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-netrcUpgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-oauthUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-http-cookieUpgrade rubygem-domain_nameUpgrade satellite-cloneUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-hammer_cli_katelloUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-hammer_cli_katelloUpgrade satellite-cliUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-clampUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-apipie-bindingsUpgrade tfm-rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-fast_gettextUpgrade rubygem-unfUpgrade tfm-runtimeUpgrade rubygem-multi_jsonUpgrade rubygem-little-plugger | Jul 14, 2022 | Feb 11, 2022 |
| Rocky_linux | — | Upgrade libdb-utils-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-cxxUpgrade libdb-debuginfoUpgrade libdb-debugsource | Mar 12, 2024 | Feb 11, 2022 |
| Ruby_on_rails | — | Upgrade to the latest version of Ruby on Rails | Feb 24, 2022 | Feb 11, 2022 |
| Suse | — | Upgrade ruby2.5-rubygem-activesupport-5_1Upgrade ruby2.5-rubygem-actionpack-doc-5_1Upgrade ruby2.5-rubygem-activesupport-doc-5_1Upgrade ruby2.5-rubygem-actionpack-5_1 | Oct 26, 2022 | Feb 11, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub