CVE-2022-23634: Information Exposure when using Puma with Rails

Published Feb 11, 2022
·
Updated

Impact Prior to puma version 5.6.2, puma may not always call close on the response body. Rails, prior to version 7.0.2.2, depended on the response body being closed in order for its CurrentAttributes implementation to work correctly.

From Rails:

> Under certain circumstances response bodies will not be closed, for example a bug in a webserver[1] or a bug in a Rack middleware. In the event a response is not notified of a close, ActionDispatch::Executor will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests, especially when interacting with ActiveSupport::CurrentAttributes.

The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage.

Patches This problem is fixed in Puma versions 5.6.2 and 4.3.11.

This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2.

See: https://github.com/advisories/GHSA-wh98-p28r-vrc9 for details about the rails vulnerability

Upgrading to a patched Rails or Puma version fixes the vulnerability.

Workarounds

Upgrade to Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2.

The Rails CVE includes a middleware that can be used instead.

References

Rails CVE: CVE-2022-23633

For more information If you have any questions or comments about this advisory: Open an issue in puma See our security policy

Other sources

A flaw was found in Puma and Rails rubygems when response bodies were not closed under certain situations. This flaw allows an attacker, by iterating certain requests, to take advantage of this issue and affect CurrentAttributes, leading to leaked data.

Puma is a Ruby/Rack web server built for parallelism. Prior to puma version 5.6.2, puma may not always call close on the response body. Rails, prior to version 7.0.2.2, depended on the response body being closed in order for its CurrentAttributes implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails or Puma version fixes the vulnerability.

— Ubuntu

Puma may not always call close on the response body. Rails depended on the response body being closed in order for its CurrentAttributes implementation to work correctly.

References:

https://github.com/advisories/GHSA-rmj8-8hhh-gv5h https://github.com/advisories/GHSA-wh98-p28r-vrc9

— Red Hat

Affected Software

25 affected componentsFixes available
redhat/tfm-rubygem-puma<0:5.6.2-1.el7
0:5.6.2-1.el7
redhat/rubygem-puma<0:5.6.2-1.el8
0:5.6.2-1.el8
rubygems/puma<4.3.11
4.3.11
rubygems/puma>=5.0.0<5.6.2
5.6.2
redhat/rubygem-puma<5.6.2
5.6.2
redhat/rubygem-puma<4.3.11
4.3.11
redhat/rubygem-rails<7.02.2
7.02.2
redhat/rubygem-rails<6.1.4.6
6.1.4.6
redhat/rubygem-rails<6.0.4.6
6.0.4.6
redhat/rubygem-rails<5.2.6.2
5.2.6.2
debian/puma<=3.12.0-2+deb10u2, <=4.3.8-1
3.12.0-2+deb10u34.3.8-1+deb11u25.6.5-36.4.2-4
ubuntu/puma<3.12.4-1ubuntu2+
3.12.4-1ubuntu2+
ubuntu/puma<5.5.2-2ubuntu2+
5.5.2-2ubuntu2+
Puma Puma Ruby<4.3.11
Puma Puma Ruby>=5.0.0<5.6.2
rubyonrails Rails>=5.0.0<5.2.6.2
rubyonrails Rails>=6.0.0<6.0.4.6
rubyonrails Rails>=6.1.0<6.1.4.6
rubyonrails Rails>=7.0.0<7.0.2.2
Debian Debian Linux=9.0
Debian Debian Linux=10.0
Debian Debian Linux=11.0
Fedoraproject Fedora=35
Fedoraproject Fedora=36
Fedoraproject Fedora=37

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/tfm-rubygem-puma to a version that resolves this vulnerability.

    Fixed in 0:5.6.2-1.el7
  2. Upgrade

    Upgrade redhat/rubygem-puma to a version that resolves this vulnerability.

    Fixed in 0:5.6.2-1.el8
  3. Upgrade

    Upgrade rubygems/puma to a version that resolves this vulnerability.

    Fixed in 4.3.11
  4. Upgrade

    Upgrade rubygems/puma to a version that resolves this vulnerability.

    Fixed in 5.6.2
  5. Upgrade

    Upgrade redhat/rubygem-puma to a version that resolves this vulnerability.

    Fixed in 5.6.2
  6. Upgrade

    Upgrade redhat/rubygem-puma to a version that resolves this vulnerability.

    Fixed in 4.3.11
  7. Upgrade

    Upgrade redhat/rubygem-rails to a version that resolves this vulnerability.

    Fixed in 7.02.2
  8. Upgrade

    Upgrade redhat/rubygem-rails to a version that resolves this vulnerability.

    Fixed in 6.1.4.6
  9. Upgrade

    Upgrade redhat/rubygem-rails to a version that resolves this vulnerability.

    Fixed in 6.0.4.6
  10. Upgrade

    Upgrade redhat/rubygem-rails to a version that resolves this vulnerability.

    Fixed in 5.2.6.2
  11. Upgrade

    Upgrade debian/puma to a version that resolves this vulnerability.

    Fixed in 3.12.0-2+deb10u3Fixed in 4.3.8-1+deb11u2Fixed in 5.6.5-3Fixed in 6.4.2-4
  12. Upgrade

    Upgrade ubuntu/puma to a version that resolves this vulnerability.

    Fixed in 3.12.4-1ubuntu2+
  13. Upgrade

    Upgrade ubuntu/puma to a version that resolves this vulnerability.

    Fixed in 5.5.2-2ubuntu2+
  14. Upgrade

    Upgrade debian/puma to a version that resolves this vulnerability.

    Fixed in 3.12.0-2+deb10u3
  15. Upgrade

    Upgrade debian/puma to a version that resolves this vulnerability.

    Fixed in 4.3.8-1+deb11u2
  16. Upgrade

    Upgrade debian/puma to a version that resolves this vulnerability.

    Fixed in 5.6.5-3
  17. Upgrade

    Upgrade debian/puma to a version that resolves this vulnerability.

    Fixed in 6.4.2-4

Event History

Feb 11, 2022
CVE Published
12:00 AM
Advisory Published
via GitHub·09:33 PM
CVE Published
via MITRE·09:40 PM
Data Sourced
via MITRE·09:40 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Mar 7, 2024
Data Sourced
via Launchpad·04:38 PM
Description

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is CVE-2022-23634?

CVE-2022-23634 is a vulnerability found in Puma and Rails rubygems that allows the response body to remain unclosed under certain situations.

2

What is the impact of CVE-2022-23634?

The vulnerability impacts Puma versions prior to 5.6.2 and Rails versions prior to 7.0.2.2, causing the response body to not be closed properly and affecting Rails' CurrentAttributes implementation.

3

How can I fix CVE-2022-23634?

To fix CVE-2022-23634, ensure that you are using Puma version 5.6.2 or later and Rails version 7.0.2.2 or later.

4

What is the severity of CVE-2022-23634?

CVE-2022-23634 has a severity rating of high.

5

Where can I find more information about CVE-2022-23634?

You can find more information about CVE-2022-23634 on CVE.org, NVD, GitHub, Red Hat Bugzilla, and Red Hat Access.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203