CVE-2022-23633

    Dashboard / Vulnerabilities / CVE-2022-23633

    CVE-2022-23633

    Published: 11 Feb 2022Last Modified: 9 Sept 2026

    Summary: Exposure of sensitive information in Action Pack

    Details: Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23633.json, https://github.com/rails/rails/security/advisories/GHSA-wh98-p28r-vrc9, https://nvd.nist.gov/vuln/detail/CVE-2022-23633, https://security.netapp.com/advisory/ntap-20240119-0013/, https://www.debian.org/security/2023/dsa-5372, https://github.com/rails/rails/commit/f9a2ad03943d5c2ba54e1d45f155442b519c75da, http://www.openwall.com/lists/oss-security/2022/02/11/5, https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 2efddadd6cba4e2129acedf1d402d11abcc03996
    Fixed -46fe51b4875ba947cd3317cef420042f22aa8ffd

    Affected versions

    v6.0.4.5
    v6.0.4.4
    v6.0.4.3
    v6.0.4.2
    v6.0.4.1
    v6.0.4
    v6.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-23633 | CVE-DB