PT-2022-7649 · Puma+8 · Puma+8
Nateberkopec
·
Published
2022-02-11
·
Updated
2026-03-13
·
CVE-2022-23634
CVSS v3.1
8.0
High
| Vector | AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Puma versions prior to 5.6.2
Puma version 4.3.11
Rails versions prior to 7.0.2.2
Rails versions prior to 6.1.4.6
Rails versions prior to 6.0.4.6
Rails versions prior to 5.2.6.2
Description
The issue is related to information leakage due to Puma not always calling
close on the response body and Rails depending on the response body being closed for its CurrentAttributes implementation to work correctly. This combination of behaviors causes information leakage. The problem can be exploited by an attacker to gain access to confidential information.Recommendations
For Puma versions prior to 5.6.2, upgrade to version 5.6.2 or 4.3.11.
For Rails versions prior to 7.0.2.2, upgrade to version 7.0.2.2.
For Rails versions prior to 6.1.4.6, upgrade to version 6.1.4.6.
For Rails versions prior to 6.0.4.6, upgrade to version 6.0.4.6.
For Rails versions prior to 5.2.6.2, upgrade to version 5.2.6.2.
As a temporary workaround, consider using the provided middleware to guard against the issue.
Exploit
Fix
Improper Resource Release
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Puma
Rails
Red Os
Rocky Linux
Suse
Ubuntu