Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.
CVSS Details
- CVSS 3.1 Base Score: 7.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-domain_nameUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-mime-typesUpgrade tfm-rubygem-jwtUpgrade rubygem-netrcUpgrade rubygem-multi_jsonUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-netrcUpgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-little-pluggerUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-clampUpgrade tfm-rubygem-rest-clientUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-oauthUpgrade rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-highlineUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-hashieUpgrade rubygem-unicode-debuginfoUpgrade satellite-cliUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-localeUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-unicodeUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-foreman_maintainUpgrade satellite-maintainUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-apipie-bindingsUpgrade satellite-cloneUpgrade rubygem-amazing_printUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-unfUpgrade rubygem-unf_extUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-amazing_printUpgrade rubygem-domain_nameUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-powerbarUpgrade foreman-cliUpgrade rubygem-powerbarUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-fast_gettextUpgrade rubygem-oauthUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-clampUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-http-cookieUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-localeUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-runtimeUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-rest-clientUpgrade rubygem-jwtUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cliUpgrade rubygem-unicode-debugsourceUpgrade tfm-rubygem-mime-types | Jul 14, 2022 | Feb 11, 2022 |
| Debian | — | Upgrade rails | Sep 6, 2022 | Feb 11, 2022 |
| Redhat_linux | — | Upgrade rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-jwtUpgrade rubygem-fast_gettextUpgrade rubygem-hashieUpgrade rubygem-rest-clientUpgrade satellite-maintainUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-amazing_printUpgrade tfm-rubygem-netrcUpgrade rubygem-unicode-debuginfoUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-highlineUpgrade rubygem-oauthUpgrade rubygem-hammer_cliUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-mime-types-dataUpgrade foreman-cliUpgrade tfm-rubygem-domain_nameUpgrade rubygem-jwtUpgrade rubygem-localeUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-highlineUpgrade rubygem-clampUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-rest-clientUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-hashieUpgrade rubygem-foreman_maintainUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-hammer_cli_katelloUpgrade tfm-rubygem-oauthUpgrade rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-unf_extUpgrade rubygem-domain_nameUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-runtimeUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-amazing_printUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-apipie-bindingsUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-mime-typesUpgrade tfm-rubygem-unfUpgrade rubygem-little-pluggerUpgrade satellite-cliUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unicode-display_widthUpgrade rubygem-powerbarUpgrade rubygem-netrcUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-clampUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade satellite-cloneUpgrade rubygem-http-cookieUpgrade rubygem-loggingUpgrade rubygem-unf_extUpgrade tfm-rubygem-http-cookieUpgrade rubygem-multi_jsonUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_azure_rm | Jul 14, 2022 | Feb 11, 2022 |
| Rocky_linux | — | Upgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-debuginfoUpgrade libdb-debugsourceUpgrade libdb-cxx | Mar 12, 2024 | Feb 11, 2022 |
| Ruby_on_rails | — | Upgrade to the latest version of Ruby on Rails | Feb 24, 2022 | Feb 11, 2022 |
| Suse | — | Upgrade ruby2.5-rubygem-actionpack-doc-5_1Upgrade ruby2.5-rubygem-activesupport-5_1Upgrade ruby2.5-rubygem-actionpack-5_1Upgrade ruby2.5-rubygem-activesupport-doc-5_1 | Oct 26, 2022 | Feb 11, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub