{
  "threat_severity" : "Moderate",
  "public_date" : "2022-02-11T00:00:00Z",
  "bugzilla" : {
    "description" : "rubygem-actionpack: information leak between requests",
    "id" : "2063149",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2063149"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.9",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-212",
  "details" : [ "Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.", "A flaw was found in the Rack middleware package of RubyGems, where response bodies will not close under certain circumstances. This flaw allows an attacker to iterate requests to force ActionDispatch::Executor to not close, allowing subsequent requests to leak data from ActiveSupport::CurrentAttributes." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Satellite 6.11 for RHEL 7",
    "release_date" : "2022-07-05T00:00:00Z",
    "advisory" : "RHSA-2022:5498",
    "cpe" : "cpe:/a:redhat:satellite:6.11::el7",
    "package" : "tfm-rubygem-actionpack-0:6.0.4.7-1.el7sat"
  }, {
    "product_name" : "Red Hat Satellite 6.11 for RHEL 8",
    "release_date" : "2022-07-05T00:00:00Z",
    "advisory" : "RHSA-2022:5498",
    "cpe" : "cpe:/a:redhat:satellite:6.11::el8",
    "package" : "tfm-rubygem-actionpack-0:6.0.4.7-1.el8sat"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2022-23633\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-23633\nhttps://github.com/rails/rails/security/advisories/GHSA-wh98-p28r-vrc9" ],
  "name" : "CVE-2022-23633",
  "mitigation" : {
    "value" : "A workaround for this problem:\n~~~\nclass GuardedExecutor < ActionDispatch::Executor\ndef call(env)\nensure_completed!\nsuper\nend\nprivate\ndef ensure_completed!\n@executor.new.complete! if @executor.active?\nend\nend\n# Ensure the guard is inserted before ActionDispatch::Executor\nRails.application.configure do\nconfig.middleware.swap ActionDispatch::Executor, GuardedExecutor, executor\nend\n~~~",
    "lang" : "en:us"
  },
  "csaw" : false
}