Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-highlineUpgrade rubygem-mime-types-dataUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-localeUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-netrcUpgrade tfm-rubygem-unicodeUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-rest-clientUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_katelloUpgrade satellite-cliUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-oauthUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-mime-typesUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-clampUpgrade rubygem-netrcUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-foreman_maintainUpgrade satellite-maintainUpgrade tfm-rubygem-domain_nameUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hashieUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-jwtUpgrade rubygem-unicode-debugsourceUpgrade tfm-rubygem-clampUpgrade rubygem-unicodeUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-mime-typesUpgrade rubygem-rest-clientUpgrade rubygem-jwtUpgrade rubygem-apipie-bindingsUpgrade tfm-runtimeUpgrade tfm-rubygem-powerbarUpgrade foreman-cliUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-oauthUpgrade tfm-rubygem-amazing_printUpgrade rubygem-unf_extUpgrade rubygem-domain_nameUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-mime-types-dataUpgrade satellite-cloneUpgrade tfm-rubygem-unfUpgrade rubygem-localeUpgrade rubygem-amazing_printUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-fast_gettextUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_remote_execution | Jul 14, 2022 | Feb 11, 2022 |
| Debian | — | Upgrade rails | Sep 6, 2022 | Feb 11, 2022 |
| Redhat_linux | — | Upgrade tfm-rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-http-cookieUpgrade rubygem-loggingUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-powerbarUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unf_extUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-amazing_printUpgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-oauthUpgrade rubygem-little-pluggerUpgrade rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-netrcUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-unf_extUpgrade tfm-runtimeUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-loggingUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-hammer_cli_katelloUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-domain_nameUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-mime-typesUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-unicodeUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-clampUpgrade rubygem-unfUpgrade rubygem-apipie-bindingsUpgrade satellite-cliUpgrade tfm-rubygem-hammer_cli_foremanUpgrade satellite-maintainUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-netrcUpgrade rubygem-rest-clientUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cliUpgrade rubygem-oauthUpgrade rubygem-amazing_printUpgrade tfm-rubygem-multi_jsonUpgrade tfm-rubygem-highlineUpgrade rubygem-localeUpgrade tfm-rubygem-domain_nameUpgrade rubygem-mime-types-dataUpgrade rubygem-clampUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade foreman-cliUpgrade tfm-rubygem-rest-clientUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-unicode-debuginfoUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-jwtUpgrade rubygem-hashieUpgrade rubygem-foreman_maintainUpgrade rubygem-jwtUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-highline | Jul 14, 2022 | Feb 11, 2022 |
| Rocky_linux | — | Upgrade libdb-cxxUpgrade libdb-debugsourceUpgrade libdb-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-utils-debuginfo | Mar 12, 2024 | Feb 11, 2022 |
| Ruby_on_rails | — | Upgrade to the latest version of Ruby on Rails | Feb 24, 2022 | Feb 11, 2022 |
| Suse | — | Upgrade ruby2.5-rubygem-actionpack-5_1Upgrade ruby2.5-rubygem-activesupport-doc-5_1Upgrade ruby2.5-rubygem-activesupport-5_1Upgrade ruby2.5-rubygem-actionpack-doc-5_1 | Oct 26, 2022 | Feb 11, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub