# \[CVE-2022-23633\] Possible exposure of information vulnerability in Action Pack

**URL:** <https://discuss.rubyonrails.org/t/cve-2022-23633-possible-exposure-of-information-vulnerability-in-action-pack/80016>\
**Category:** Security Announcements\
**Created:** [February 11, 2022, 8:18pm UTC](https://discuss.rubyonrails.org/t/cve-2022-23633-possible-exposure-of-information-vulnerability-in-action-pack/80016 "2022-02-11T20:18:52Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![tenderlove](https://sea2.discourse-cdn.com/rubyonrails/user_avatar/discuss.rubyonrails.org/tenderlove/32/3541_2.png) [@tenderlove](https://discuss.rubyonrails.org/u/tenderlove)\
**Post date:** [February 11, 2022, 8:18pm UTC](https://discuss.rubyonrails.org/t/cve-2022-23633-possible-exposure-of-information-vulnerability-in-action-pack/80016/1 "2022-02-11T20:18:52Z")

</div>

## Impact

Under certain circumstances response bodies will not be closed, for example a bug in a webserver[1] or a bug in a Rack middleware. In the event a response is not notified of a close, ActionDispatch::Executor will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests, especially when interacting with ActiveSupport::CurrentAttributes.

Upgrading to the FIXED versions of Rails will ensure mitigation if this issue even in the context of a buggy webserver or middleware implementation.

## Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

- 5.2-information-leak.patch
- 6.0-information-leak.patch
- 6.1-information-leak.patch
- 7.0-information-leak.patch

## Workarounds

Upgrading is highly recommended, but to work around this problem the following middleware can be used:

```ruby
class GuardedExecutor < ActionDispatch::Executor
  def call(env)
    ensure_completed!
    super
  end

  private

    def ensure_completed!
      @executor.new.complete! if @executor.active?
    end
end

# Ensure the guard is inserted before ActionDispatch::Executor
Rails.application.configure do
  config.middleware.swap ActionDispatch::Executor, GuardedExecutor, executor
end

```

## Credits

Thanks to Jean Boussier for fixing this!

1. [Always send lowlevel\_error response to client by baelter · Pull Request #2812 · puma/puma · GitHub](https://github.com/puma/puma/pull/2812)

[5.2-information-leak.patch](https://discuss.rubyonrails.org/uploads/short-url/dTQTJAXXFnTn7OzMxXnRkBbV69L.patch) (4.1 KB) [6.0-information-leak.patch](https://discuss.rubyonrails.org/uploads/short-url/oJRZUo7NuHpSH96xjmLGU7t767t.patch) (4.1 KB) [6.1-information-leak.patch](https://discuss.rubyonrails.org/uploads/short-url/9C5jU49Si4VchyQNrtii2q0i5FC.patch) (4.1 KB) [7.0-information-leak.patch](https://discuss.rubyonrails.org/uploads/short-url/nEaQzS8EylVrLFHL4cHAebP7RvO.patch) (5.3 KB)