CVE-2022-23633: Exposure of sensitive information in Action Pack
First published: Fri Feb 11 2022(Updated: )
### Impact Under certain circumstances response bodies will not be closed, for example a [bug in a webserver](https://github.com/puma/puma/pull/2812) or a bug in a Rack middleware. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests, especially when interacting with `ActiveSupport::CurrentAttributes`. Upgrading to the FIXED versions of Rails will ensure mitigation of this issue even in the context of a buggy webserver or middleware implementation. ### Patches This has been fixed in Rails 7.0.2.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. ### Workarounds Upgrading is highly recommended, but to work around this problem the following middleware can be used: ```ruby class GuardedExecutor < ActionDispatch::Executor def call(env) ensure_completed! super end private def ensure_completed! @executor.new.complete! if @executor.active? end end # Ensure the guard is inserted before ActionDispatch::Executor Rails.application.configure do config.middleware.swap ActionDispatch::Executor, GuardedExecutor, executor end ```
Credit: security-advisories@github.com security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/rails | <=2:6.0.3.7+dfsg-2<=2:6.1.4.1+dfsg-8 | |
| rubygems/actionpack | >=7.0.0.0<=7.0.2.1 | 7.0.2.2 |
| rubygems/actionpack | >=6.1.0.0<=6.1.4.5 | 6.1.4.6 |
| rubygems/actionpack | >=6.0.0.0<=6.0.4.5 | 6.0.4.6 |
| rubygems/actionpack | >=5.0.0.0<=5.2.6.1 | 5.2.6.2 |
| >=5.0.0<5.2.6.2 | ||
| >=6.0.0<6.0.4.6 | ||
| >=6.1.0<6.1.4.6 | ||
| >=7.0.0<7.0.2.2 | ||
| =10.0 | ||
| =11.0 | ||
| Rubyonrails Rails | >=5.0.0<5.2.6.2 | |
| Rubyonrails Rails | >=6.0.0<6.0.4.6 | |
| Rubyonrails Rails | >=6.1.0<6.1.4.6 | |
| Rubyonrails Rails | >=7.0.0<7.0.2.2 | |
| Debian Debian Linux | =10.0 | |
| Debian Debian Linux | =11.0 | |
| redhat/rails | <7.0.2.1 | 7.0.2.1 |
| redhat/rails | <6.1.4.5 | 6.1.4.5 |
| redhat/rails | <6.0.4.5 | 6.0.4.5 |
| redhat/rails | <5.2.6.1 | 5.2.6.1 |
| debian/rails | <=2:5.2.2.1+dfsg-1+deb10u3 | 2:5.2.2.1+dfsg-1+deb10u5 2:6.0.3.7+dfsg-2+deb11u2 2:6.1.7.3+dfsg-1 2:6.1.7.3+dfsg-2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.openwall.com/lists/oss-security/2022/02/11/5
- https://github.com/rails/rails/commit/07d9600172a18b45791c89e95a642e13fc367545
- https://github.com/rails/rails/commit/d1267768e9f57ebcf86ff7f011aca7fb08e733eb
- https://github.com/rails/rails/commit/e9015f91dd685472f915f8aa1eb18b0e0763e013
- https://github.com/rails/rails/commit/f85b396e5a0019eb614e4ee436ea713089696833
- https://github.com/rails/rails/commit/ddaf5058350b3a72f59b7c3e0d713678354b9a08
- https://github.com/rails/rails/commit/676ad96fa5d9d0213babc32c9bad8190597a00d1
- https://security-tracker.debian.org/tracker/CVE-2022-23633
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23633
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1005389
- http://www.openwall.com/lists/oss-security/2022/02/11/5
- https://github.com/rails/rails/commit/f9a2ad03943d5c2ba54e1d45f155442b519c75da
- https://github.com/rails/rails/security/advisories/GHSA-wh98-p28r-vrc9
- https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html
- https://www.debian.org/security/2023/dsa-5372
- https://discuss.rubyonrails.org/t/cve-2022-23633-possible-exposure-of-information-vulnerability-in-action-pack/80016
- https://rubyonrails.org/2022/2/11/Rails-7-0-2-2-6-1-4-6-6-0-4-6-and-5-2-6-2-have-been-released
- https://nvd.nist.gov/vuln/detail/CVE-2022-23633
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2022-23633.yml
- https://groups.google.com/g/ruby-security-ann/c/FkTM-_7zSNA/m/K2RiMJBlBAAJ
- https://github.com/advisories/GHSA-wh98-p28r-vrc9 (Advisory)
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2063150
- https://access.redhat.com/errata/RHSA-2022:5498
- https://access.redhat.com/security/cve/cve-2022-23633
- https://bugzilla.redhat.com/show_bug.cgi?id=2063149
- https://security.netapp.com/advisory/ntap-20240119-0013/
Frequently Asked Questions
What is CVE-2022-23633?
CVE-2022-23633 is a vulnerability in the Action Pack framework which can cause response bodies to not be closed under certain circumstances.
How does CVE-2022-23633 impact the system?
CVE-2022-23633 can result in response bodies not being closed, leading to potential information leakage and thread local variable pollution.
Which software versions are affected by CVE-2022-23633?
CVE-2022-23633 affects Rails versions 5.2.2.1 to 2:5.2.2.1+dfsg-1+deb10u5, 6.0.3.7 to 2:6.0.3.7+dfsg-2+deb11u2, and 6.1.7.3 to 2:6.1.7.3+dfsg-2.
How severe is CVE-2022-23633?
CVE-2022-23633 has a severity rating of 7.4 (high).
How can I fix CVE-2022-23633?
To fix CVE-2022-23633, it is recommended to update Rails to versions not affected by the vulnerability and apply any available patches.
- collector/security-tracker-debian
- collector/debian-bugs
- alias/CVE-2022-23633
- collector/nvd-index
- agent/type
- agent/remedy
- agent/softwarecombine
- agent/severity
- agent/weakness
- agent/description
- collector/github-advisory
- source/GitHub
- alias/GHSA-wh98-p28r-vrc9
- agent/software-canonical-lookup
- collector/redhat-bugzilla
- source/Red Hat
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/references
- agent/first-publish-date
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/author
- agent/tags
- collector/nvd-cve
- collector/github-advisory-latest
- package-manager/debian
- vendor/rubyonrails
- canonical/rubyonrails rails
- version/rubyonrails rails/5.0.0
- version/rubyonrails rails/6.0.0
- version/rubyonrails rails/6.1.0
- version/rubyonrails rails/7.0.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/10.0
- version/debian debian linux/11.0
- package-manager/rubygems
- package-manager/redhat