rubyonrails rails CVE-2022-23633 in Ruby on Rails and Debian Products
Published on February 11, 2022

product logo product logo
Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.

Github Repository Github Repository Vendor Advisory NVD

Vulnerability Analysis

CVE-2022-23633 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
NONE

Weakness Type

What is an Information Disclosure Vulnerability?

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVE-2022-23633 has been classified to as an Information Disclosure vulnerability or weakness.


Products Associated with CVE-2022-23633

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2022-23633 are published in these products:

Ruby on Rails Rails
 
Debian Linux
 

Affected Versions

rails:

Vulnerable Packages

The following package name and versions may be associated with CVE-2022-23633

Package Manager Vulnerable Package Versions Fixed In
rubygems puma >= 5.0.0, < 5.6.2 5.6.2
rubygems puma < 4.3.11 4.3.11
rubygems actionpack >= 5.0.0.0, <= 5.2.6.1 5.2.6.2
rubygems actionpack >= 6.0.0.0, <= 6.0.4.5 6.0.4.6
rubygems actionpack >= 6.1.0.0, <= 6.1.4.5 6.1.4.6
rubygems actionpack >= 7.0.0.0, <= 7.0.2.1 7.0.2.2

Exploit Probability

EPSS
0.37%
Percentile
58.19%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.