CVE catalog

CVE-2022-23633

rails: CVE-2022-23633

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
2.22% · Oct 22, 2026

Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrailssid2:7.2.4+dfsg-2fixed
Debianrailsforky2:7.2.4+dfsg-1fixed
Debianrailstrixie2:7.2.2.2+dfsg-2~deb13u1fixed
Debianrailstrixie-security2:7.2.2.2+dfsg-2~deb13u2fixed
Debianrailsbookworm2:6.1.7.10+dfsg-1~deb12u2fixed
Debianrailsbookworm-security2:6.1.7.10+dfsg-1~deb12u3fixed
Opensuserubygem-actionpack-7.0tumbleweed7.0.2.2-1.1fixed
Opensuserubygem-actionpack-7.0tumbleweed7.0.8.4-1.1fixed
Opensuserubygem-actionpack-6.0tumbleweed6.0.4.6-1.1fixed
Opensuserubygem-actionpack-7.0tumbleweed7.0.8.6-1.3fixed
Opensuseruby3.2-rubygem-actionpack-7.0tumbleweed7.0.4.3-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrailssourcesid2:6.1.4.6+dfsg-1not yet assignedNot reported[1005389]
Debianrailssourceforky2:6.1.4.6+dfsg-1not yet assignedNot reported[1005389]
Debianrailssourcetrixie2:6.1.4.6+dfsg-1not yet assignedNot reported[1005389]
Debianrailssourcebookworm2:6.1.4.6+dfsg-1not yet assignedNot reported[1005389]
Opensuserubygem-actionpack-7.0rpmtumbleweed7.0.2.2-1.1Not reportedOPENSUSE-SU-2024:11899-1Not reported
Opensuserubygem-actionpack-7.0rpmtumbleweed7.0.8.4-1.1Not reportedOPENSUSE-SU-2024:14067-1Not reported
Opensuserubygem-actionpack-6.0rpmtumbleweed6.0.4.6-1.1Not reportedOPENSUSE-SU-2024:11869-1Not reported
Opensuserubygem-actionpack-7.0rpmtumbleweed7.0.8.6-1.3Not reportedOPENSUSE-SU-2025:15110-1Not reported
Opensuseruby3.2-rubygem-actionpack-7.0rpmtumbleweed7.0.4.3-1.1Not reportedOPENSUSE-SU-2024:12878-1Not reported

[Debian bug #1005389]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [rails]Fixed
    Details (4)

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

  • [ruby-actioncable]Fixed

    Source package: [rails]

    Details (4)

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

  • [ruby-actionmailbox]Fixed

    Source package: [rails]

    Details (4)

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

  • [ruby-actionmailer]Fixed

    Source package: [rails]

    Details (4)

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

  • [ruby-actionpack]Fixed

    Source package: [rails]

    Details (4)

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

  • [ruby-actiontext]Fixed

    Source package: [rails]

    Details (4)

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

  • [ruby-actionview]Fixed

    Source package: [rails]

    Details (4)

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

  • [ruby-activejob]Fixed

    Source package: [rails]

    Details (4)

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

  • [ruby-activemodel]Fixed

    Source package: [rails]

    Details (4)

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

  • [ruby-activerecord]Fixed

    Source package: [rails]

    Details (4)

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

  • [ruby-activestorage]Fixed

    Source package: [rails]

    Details (4)

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

  • [ruby-activesupport]Fixed

    Source package: [rails]

    Details (4)

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

  • [ruby-rails]Fixed

    Source package: [rails]

    Details (4)

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

  • [ruby-railties]Fixed

    Source package: [rails]

    Details (4)

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

    • 2:6.1.7.10+dfsg-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 2:6.1.4.6+dfsg-1

      dsa · rails · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]