Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2022-23633
7.4
HIGHCVSS v3
Published
February 11, 2022
CVSS v2
4.3 MEDIUM
Affected
5 projects
Assigned by
GitHub
Severity scale
010
Description
Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.
rails
RubyGemsRuby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.
RubyGemsRuby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.>= 7.0.0, < 7.0.2.2, >= 6.1.0, < 6.1.4.6, >= 6.0.0, < 6.0.4.6, >= 5.0.0, < 5.2.6.2NVD
rails/rails
GitHubRuby on Rails
GitHubRuby on Rails>= 7.0.0, < 7.0.2.2, >= 6.1.0, < 6.1.4.6, >= 6.0.0, < 6.0.4.6, >= 5.0.0, < 5.2.6.2NVD
NPM
Docker Hub