Bug 2054211 (CVE-2022-23634)
| Summary: | CVE-2022-23634 rubygem-puma: rubygem-rails: information leak between requests | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Marian Rehak <mrehak> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | akarol, bbuckingham, bcourt, btotty, dmetzger, ehelms, gmccullo, gtanzill, jaruga, jfrey, jhardy, jsherril, lzap, mhulan, mmccune, mo, mtasaka, myarboro, nmoumoul, obarenbo, orabin, pcreech, pvalena, rchan, roliveri, ruby-packagers-sig, simaishi, smallamp, sseago, s, strzibny, tdawson, vondruch |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | rubygem-puma 5.6.2, rubygem-puma 4.3.11, rubygem-rails 7.02.2, rubygem-rails 6.1.4.6, rubygem-rails 6.0.4.6, rubygem-rails 5.2.6.2 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in Puma and Rails rubygems when response bodies were not closed under certain situations. This flaw allows an attacker, by iterating certain requests, to take advantage of this issue and affect CurrentAttributes, leading to leaked data.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-07-05 21:40:50 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2054212, 2054213, 2058653, 2058654 | ||
| Bug Blocks: | 2054214 | ||
|
Description
Marian Rehak
2022-02-14 12:53:47 UTC
Created rubygem-puma tracking bugs for this issue: Affects: fedora-all [bug 2054212] Created rubygem-rails tracking bugs for this issue: Affects: fedora-all [bug 2054213] This issue has been addressed in the following products: Red Hat Satellite 6.11 for RHEL 7 Red Hat Satellite 6.11 for RHEL 8 Via RHSA-2022:5498 https://access.redhat.com/errata/RHSA-2022:5498 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-23634 (In reply to Marian Rehak from comment #0) > Puma may not always call `close` on the response body. Rails depended on the > response body being closed in order for its `CurrentAttributes` > implementation to work correctly. > > References: > > https://github.com/advisories/GHSA-rmj8-8hhh-gv5h > https://github.com/advisories/GHSA-wh98-p28r-vrc9 I don't understand why the 2 links are here together in the References. It seems the 1st link is for the puma gem and rails gem to pull the latest puma. But the 2nd link is for actionpack gem. I don't understand why the 2nd link is related. Why did you put the second link? Do you think we need to fix actionpack gem too? FEDORA-2022-de968d1b6c has been pushed to the Fedora 35 stable repository. If problem still persists, please make note of it in this bug report. FEDORA-2022-52d0032596 has been pushed to the Fedora 36 stable repository. If problem still persists, please make note of it in this bug report. |