{"id":"CVE-2022-23633","aliases":["DEBIAN-CVE-2022-23633","DLA-3093-1","DSA-5372-1","EUVD-2022-1229","GHSA-wh98-p28r-vrc9","OESA-2024-1762","OESA-2024-1763","OESA-2024-1764","OESA-2024-1777","OESA-2024-1778","OESA-2024-1779","OESA-2024-1810","RHSA-2022:5498","RLSA-2022:5498","SUSE-SU-2022:2108-1","UBUNTU-CVE-2022-23633","openSUSE-SU-2024:11869-1","openSUSE-SU-2024:11899-1","openSUSE-SU-2024:12878-1","openSUSE-SU-2024:14067-1","openSUSE-SU-2025:15110-1"],"status":"published","title":"Exposure of sensitive information in Action Pack","description":"Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.02217,"percentile":0.82777,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-212"],"published":"2022-02-11T00:00:00Z","modified":"2026-11-03T08:02:11Z","fixes":[{"ecosystem":"RubyGems","package":"actionpack","fixed_in":["5.2.6.2","6.0.4.6","6.1.4.6","7.0.2.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"rails","fixed_in":["2:6.1.4.6+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rails","fixed_in":["2:6.1.4.6+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rails","fixed_in":["2:6.1.4.6+dfsg-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"rubygem-activesupport","fixed_in":["5.2.4.4-5.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"rubygem-activesupport","fixed_in":["6.1.4.1-8.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"rubygem-activesupport","fixed_in":["6.1.4.1-8.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"rubygem-actionpack","fixed_in":["5.2.4.4-5.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"rubygem-actionpack","fixed_in":["6.1.4.1-6.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"rubygem-actionpack","fixed_in":["6.1.4.1-6.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"rubygem-actionpack","fixed_in":["6.1.4.1-6.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"rubygem-actionpack-6.0","fixed_in":["6.0.4.6-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"rubygem-actionpack-7.0","fixed_in":["7.0.2.2-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-actionpack-7.0","fixed_in":["7.0.4.3-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0.0"},{"last_affected":"5.2.6.1"},{"fixed":"5.2.6.2"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0.0"},{"last_affected":"6.0.4.5"},{"fixed":"6.0.4.6"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0.0"},{"last_affected":"6.1.4.5"},{"fixed":"6.1.4.6"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0.0"},{"last_affected":"7.0.2.1"},{"fixed":"7.0.2.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.1.4.6+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.1.4.6+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.1.4.6+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:5.2.2.1+dfsg-1+deb10u4"}]}],"versions":["2:5.2.2.1+dfsg-1","2:5.2.2.1+dfsg-1+deb10u1","2:5.2.2.1+dfsg-1+deb10u2","2:5.2.2.1+dfsg-1+deb10u3"],"bundled":4},{"source":"osv","ecosystem":"Debian:11","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.0.3.7+dfsg-2+deb11u1"}]}],"versions":["2:6.0.3.7+dfsg-2"],"bundled":10},{"source":"osv","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0.0"},{"fixed":"5.2.6.2"}]}],"versions":["5.0.0","5.0.0.1","5.0.1","5.0.1.rc1","5.0.1.rc2","5.0.2","5.0.2.rc1","5.0.3","5.0.4","5.0.4.rc1","5.0.5","5.0.5.rc1","5.0.5.rc2","5.0.6","5.0.6.rc1","5.0.7","5.0.7.1","5.0.7.2","5.1.0","5.1.0.beta1","5.1.0.rc1","5.1.0.rc2","5.1.1","5.1.2","5.1.2.rc1","5.1.3","5.1.3.rc1","5.1.3.rc2","5.1.3.rc3","5.1.4","5.1.4.rc1","5.1.5","5.1.5.rc1","5.1.6","5.1.6.1","5.1.6.2","5.1.7","5.1.7.rc1","5.2.0","5.2.0.beta1","5.2.0.beta2","5.2.0.rc1","5.2.0.rc2","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.3","5.2.4.4","5.2.4.5","5.2.4.6","5.2.4.rc1","5.2.5","5.2.6","5.2.6.1"]},{"source":"osv","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0.0"},{"fixed":"6.0.4.6"}]}],"versions":["6.0.0","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5"]},{"source":"osv","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0.0"},{"fixed":"6.1.4.6"}]}],"versions":["6.1.0","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5"]},{"source":"osv","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0.0"},{"fixed":"7.0.2.2"}]}],"versions":["7.0.0","7.0.1","7.0.2","7.0.2.1"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"rubygem-activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4.4-5.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"rubygem-activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4.1-8.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"rubygem-activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4.1-8.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4.4-5.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4.1-6.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4.1-6.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4.1-6.oe2203sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.11::el7","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.22-1.el7pc"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.22-1.el7pc"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.11::el8","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.22-1.el8pc"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.22-1.el8pc"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.11::el7","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.21-2.el7sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.11::el7","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.21-2.el7sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.21-2.el7sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.11::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.21-2.el8sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.11::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.21-2.el8sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1.21-2.el8sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.11::el7","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.11.0-2.el7sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.11::el7","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.11.0-2.el7sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.11.0-2.el7sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.11::el8","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.11.0-2.el8sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.11::el8","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.11.0-2.el8sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.11.0-2.el8sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"candlepin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.13-1.el7sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"candlepin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.13-1.el8sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"tfm-rubygem-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.10-1.el7sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.11::el8","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.2-2.el8pc"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.2-2.el8pc"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"tfm-rubygem-puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.2-1.el7sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"rubygem-puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.2-1.el8sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.11::el8","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.1-1.el8pc"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.1-1.el8pc"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.11::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el8pc"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el8pc"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.11::el8","package":"python38-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el8pc"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"python38-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el8pc"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"tfm-rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.4.7-1.el7sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.4.7-1.el8sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el7","package":"tfm-rubygem-puma-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.2-1.el7sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"rubygem-puma-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.2-1.el8sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"rubygem-puma-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.2-1.el8sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:satellite:6.11::el8","package":"rubygem-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.10-1.el8sat"}]}],"bundled":28},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.28-42.el8_4"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15","package":"rubygem-actionpack-5_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-150000.3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15","package":"rubygem-activesupport-5_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP1","package":"rubygem-actionpack-5_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-150000.3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP1","package":"rubygem-activesupport-5_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP2","package":"rubygem-actionpack-5_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-150000.3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP2","package":"rubygem-activesupport-5_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP3","package":"rubygem-actionpack-5_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-150000.3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP3","package":"rubygem-activesupport-5_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"rubygem-actionpack-5_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-150000.3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"rubygem-activesupport-5_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"rubygem-actionpack-5_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-150000.3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"rubygem-activesupport-5_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"rubygem-actionpack-5_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-150000.3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"rubygem-activesupport-5_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-150000.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:4.1.10-1","2:4.2.5-1","2:4.2.5.1-1","2:4.2.5.2-2","2:4.2.6-1","2:4.2.6-1ubuntu0.1~esm1","2:4.2.6-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:4.2.9-2","2:4.2.9-4","2:4.2.10-0ubuntu4","2:4.2.10-0ubuntu4+esm1","2:4.2.10-0ubuntu4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:5.2.2.1+dfsg-1ubuntu1","2:5.2.3+dfsg-3","2:5.2.3+dfsg-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.0.3.7+dfsg-2","2:6.1.4.1+dfsg-8ubuntu2","2:6.1.4.1+dfsg-8ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.1.7.3+dfsg-2build1","2:6.1.7.3+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.1.7.3+dfsg-7","2:7.2.2.1+dfsg-7"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:7.2.3+dfsg-2","2:7.2.3.2+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:7.2.2.1+dfsg-7","2:7.2.2.2+dfsg-2","2:7.2.3+dfsg-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-actionpack-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.4.6-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-actionpack-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.2.2-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-actionpack-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.4.3-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-actionpack-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8.4-1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-actionpack-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8.6-1.3"}]}],"bundled":8}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"rails","product":"rails"},{"vendor":"rubyonrails","product":"rails"}],"references":[{"url":"https://github.com/rails/rails/security/advisories/GHSA-wh98-p28r-vrc9","tags":["x_transferred","Mitigation","Third Party Advisory","advisory","web","article","report"]},{"url":"https://github.com/rails/rails/commit/f9a2ad03943d5c2ba54e1d45f155442b519c75da","tags":["x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2022/02/11/5","tags":["mailing-list","x_transferred","Mailing List","Mitigation","Patch","Third Party Advisory","article","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://www.debian.org/security/2023/dsa-5372","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240119-0013/","tags":["x_transferred","advisory"]},{"url":"https://discuss.rubyonrails.org/t/cve-2022-23633-possible-exposure-of-information-vulnerability-in-action-pack/80016","tags":["web"]},{"url":"https://rubyonrails.org/2022/2/11/Rails-7-0-2-2-6-1-4-6-6-0-4-6-and-5-2-6-2-have-been-released","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23633","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2022-23633.yml","tags":["web"]},{"url":"https://groups.google.com/g/ruby-security-ann/c/FkTM-_7zSNA/m/K2RiMJBlBAAJ","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wh98-p28r-vrc9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23633.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-23633","tags":["advisory"]},{"url":"https://github.com/rails/rails","tags":["package"]},{"url":"https://security.netapp.com/advisory/ntap-20240119-0013","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1762","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1763","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1764","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1777","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1778","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1779","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1810","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:5498","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_satellite/6.11/html/release_notes","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459231","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1473263","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1545000","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1596004","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1609543","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1659649","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1662924","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1685708","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1693733","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1694659","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1713401","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1723632","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1723751","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1735540","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1744521","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1761421","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1770075","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1771724","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1777820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1784254","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1805028","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1807258","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1807536","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1809769","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1811166","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1813624","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1819309","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1825761","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1832858","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1844848","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1845471","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1847825","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1851808","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1852897","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1862140","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1867193","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1869351","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1872688","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1873241","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1877283","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1878049","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1881668","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1883612","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1883816","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1886780","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1893059","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1896628","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1898656","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1899481","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1902047","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1902314","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1906023","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1907795","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1910433","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1911545","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1914803","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1915394","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1919146","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1920579","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1922872","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1923766","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1924625","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1927028","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1927532","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1931489","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1937364","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1937470","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1940308","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1942806","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1944802","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1944888","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1951626","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1955385","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1957070","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1957288","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1958664","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1959691","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1960228","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1962307","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1962410","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1962847","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1964394","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1965968","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1967319","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1968439","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1969748","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1969992","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1970482","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1972501","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1973146","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1974225","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1975321","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1978323","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1978689","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1979092","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1979907","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1980023","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1980166","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1982970","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1988370","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1992570","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1992624","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1992698","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1994212","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1994237","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1994397","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1994679","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1996803","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1997575","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1997818","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1998172","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1999604","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2000699","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2000703","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2000705","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2000707","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2000769","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2002995","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2004016","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2004158","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2004234","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2004335","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2005072","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2007655","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2008809","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2009049","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2009398","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2010138","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2011062","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2013495","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2013503","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2013837","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2014037","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2014244","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2014251","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2018263","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020329","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2021255","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2021352","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2021406","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2021985","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2022648","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2023809","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024269","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024553","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024889","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024894","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024963","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024978","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024986","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025049","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025437","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025494","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025523","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025760","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025811","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2026239","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2026277","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2026415","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2026658","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2026718","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2026873","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2027052","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2027968","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2028178","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2028205","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2028273","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2028377","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2028446","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2028733","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2029192","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2029375","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2029385","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2029548","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2029760","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2029807","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2029828","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2029829","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2029914","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2030101","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2030273","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2030434","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2030460","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2030715","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2031154","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2031958","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2032098","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2032400","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2032569","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2032602","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2032928","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2032956","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2033174","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2033201","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2033217","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2033336","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2033560","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2033593","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2033847","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2033853","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2033940","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2034317","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2034346","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2034461","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2034552","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2034635","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2034643","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2034649","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2034659","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2035195","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2035204","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2035480","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2035907","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2036054","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2036187","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2036381","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2036628","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2036721","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2037024","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2037025","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2037028","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2037180","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2037275","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2037508","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2037518","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2037520","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2037648","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2037706","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2037773","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2038042","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2038192","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2038241","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2038388","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2038432","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2038849","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2039289","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2039696","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040406","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040447","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040453","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040596","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040650","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040773","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040796","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040870","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2041457","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2041497","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2041508","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2041551","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2041588","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2041701","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2042416","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2042480","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2042848","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2042861","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2043081","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2043097","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2043144","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2043248","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2043501","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2043609","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2043726","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044581","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044606","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044631","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2045504","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2045854","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2046281","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2046307","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2046322","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2046328","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2046337","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2046484","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2046573","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2047285","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2047443","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2047451","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2047485","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2047649","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2047675","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2047683","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048470","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048517","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048560","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048775","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048778","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048913","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048927","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048986","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2049143","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2049304","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2049799","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2049913","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2050100","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2050297","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2050323","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2050440","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051374","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051408","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051468","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051522","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051543","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051912","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2052048","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2052088","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2052420","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2052493","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2052506","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2052524","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2052815","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2052958","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053329","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053395","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053478","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053601","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053843","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053872","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053876","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053884","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053923","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053928","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053956","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053970","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053996","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053997","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054008","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054121","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054123","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054165","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054174","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054182","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054211","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054340","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054758","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054849","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054971","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055159","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055312","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055329","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055495","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055513","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055570","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055808","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055951","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056167","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056171","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056172","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056173","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056177","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056178","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056183","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056186","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056189","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056198","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056202","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056237","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056469","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056657","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056966","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2057178","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2057309","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2057416","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2057605","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2057632","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2057658","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2057782","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2057848","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2058397","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2058532","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2058649","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2058711","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2058844","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2058863","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2058867","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2058894","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2058905","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2058984","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2059576","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2059985","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2060097","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2060396","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2060512","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2060546","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2060885","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2061688","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2061749","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2061773","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2061970","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2062189","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2062476","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2063149","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2063190","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2063575","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2063910","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064400","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064410","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064434","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064583","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064707","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064793","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2065015","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2065027","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2065391","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2065448","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2065450","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2066408","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2066899","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2067301","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2067331","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2069135","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2069248","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2069381","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2069456","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2069459","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2069640","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2070176","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2070177","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2070242","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2070272","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2070620","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072447","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072459","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072530","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2073039","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2073124","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2073194","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2073307","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2073313","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2073421","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2073468","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2073469","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2073470","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2075434","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2075519","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2075528","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2076372","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2076684","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2076987","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2077850","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2078983","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2079357","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2080909","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2081280","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2081459","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2082076","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2082241","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2082505","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2082560","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2083532","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2084106","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2084624","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2085446","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2085528","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2086101","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2086683","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2086948","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2087727","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2089361","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2089794","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2089796","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2089812","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2089928","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2090740","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2090820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2093679","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2094255","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2094280","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2094454","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2095598","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2095599","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2096198","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2096921","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5498.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3200","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3200","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3200","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3584","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3584","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3584","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-4142","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-4142","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4142","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21290","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21290","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21290","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21295","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21295","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21295","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21409","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21409","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21409","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-f256-j965-7f32","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-30151","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-30151","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-30151","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-grh7-935j-hg6w","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-32839","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-32839","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32839","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33928","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33928","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33928","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33929","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33929","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33929","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33930","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33930","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33930","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33938","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33938","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33938","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-41136","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-41136","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41136","tags":["advisory"]},{"url":"https://github.com/puma/puma/security/advisories/GHSA-48w2-rm65-62xx","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-42550","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-42550","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-42550","tags":["advisory"]},{"url":"http://logback.qos.ch/news.html","tags":["article"]},{"url":"https://cve.report/CVE-2021-42550","tags":["article"]},{"url":"https://jira.qos.ch/browse/LOGBACK-1591","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-43797","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-43797","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-43797","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-43818","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-43818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-43818","tags":["advisory"]},{"url":"https://github.com/lxml/lxml/blob/lxml-4.6.5/CHANGES.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44420","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44420","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44420","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2021/dec/07/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44568","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44568","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44568","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-45115","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-45115","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45115","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2022/jan/04/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-45116","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-45116","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45116","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-45452","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-45452","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45452","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22818","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22818","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2022/feb/01/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23633","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23633","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23634","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23634","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23634","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rmj8-8hhh-gv5h","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23833","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23833","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23833","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23837","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23837","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23837","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jrfj-98qg-qjgv","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-28346","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-28346","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28346","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2022/apr/11/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-28347","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-28347","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28347","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:5498","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222108-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1185780","tags":["report"]},{"url":"https://bugzilla.suse.com/1196182","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23633","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-23633","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2022/02/11/5","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-28103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47887","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-23633","title":"Exposure of sensitive information in Action Pack","description":"Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.","status":"published","published":"2022-02-11T00:00:00Z","modified":"2024-08-03T03:51:44.739Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:34:29.478363Z"}],"euvd":[{"id":"EUVD-2022-1229","description":"Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.","status":"published","published":"2022-02-11T00:00:00Z","modified":"2024-08-03T03:51:44Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T03:25:51.181739Z"}],"ghsa":[{"id":"GHSA-wh98-p28r-vrc9","title":"Exposure of information in Action Pack","description":"### Impact\n\nUnder certain circumstances response bodies will not be closed, for example a [bug in a webserver](https://github.com/puma/puma/pull/2812) or a bug in a Rack middleware.  In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request.  This can lead to data being leaked to subsequent requests, especially when interacting with `ActiveSupport::CurrentAttributes`.\n\nUpgrading to the FIXED versions of Rails will ensure mitigation of this issue even in the context of a buggy webserver or middleware implementation.\n\n### Patches\n\nThis has been fixed in Rails 7.0.2.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2.\n\n### Workarounds\n\nUpgrading is highly recommended, but to work around this problem the following middleware can be used:\n\n```ruby\nclass GuardedExecutor \u003c ActionDispatch::Executor\n  def call(env)\n    ensure_completed!\n    super\n  end\n\n  private\n\n    def ensure_completed!\n      @executor.new.complete! if @executor.active?\n    end\nend\n\n# Ensure the guard is inserted before ActionDispatch::Executor\nRails.application.configure do\n  config.middleware.swap ActionDispatch::Executor, GuardedExecutor, executor\nend\n```","status":"published","published":"2022-02-11T20:49:14Z","modified":"2024-01-28T05:06:17Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-200","CWE-212"],"updated_at":"2026-11-02T14:37:33.019154Z"}],"nvd":[{"id":"CVE-2022-23633","description":"Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.","status":"published","published":"2022-02-11T21:15:11.99Z","modified":"2026-06-17T04:30:31.587Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200","CWE-212"],"updated_at":"2026-11-02T14:07:12.155838Z"}],"osv":[{"id":"CVE-2022-23633","title":"Exposure of sensitive information in Action Pack","description":"Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.","status":"published","published":"2022-02-11T00:00:00Z","modified":"2026-10-28T02:31:06.238561056Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:24.061177Z"},{"id":"DEBIAN-CVE-2022-23633","description":"Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.","status":"published","published":"2022-02-11T21:15:11.99Z","modified":"2026-11-03T08:02:11.886672884Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T08:24:50.542442Z"},{"id":"GHSA-wh98-p28r-vrc9","title":"Exposure of information in Action Pack","description":"### Impact\n\nUnder certain circumstances response bodies will not be closed, for example a [bug in a webserver](https://github.com/puma/puma/pull/2812) or a bug in a Rack middleware.  In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request.  This can lead to data being leaked to subsequent requests, especially when interacting with `ActiveSupport::CurrentAttributes`.\n\nUpgrading to the FIXED versions of Rails will ensure mitigation of this issue even in the context of a buggy webserver or middleware implementation.\n\n### Patches\n\nThis has been fixed in Rails 7.0.2.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2.\n\n### Workarounds\n\nUpgrading is highly recommended, but to work around this problem the following middleware can be used:\n\n```ruby\nclass GuardedExecutor \u003c ActionDispatch::Executor\n  def call(env)\n    ensure_completed!\n    super\n  end\n\n  private\n\n    def ensure_completed!\n      @executor.new.complete! if @executor.active?\n    end\nend\n\n# Ensure the guard is inserted before ActionDispatch::Executor\nRails.application.configure do\n  config.middleware.swap ActionDispatch::Executor, GuardedExecutor, executor\nend\n```","status":"published","published":"2022-02-11T20:49:14Z","modified":"2026-02-04T04:00:06.851323Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-200","CWE-212"],"updated_at":"2026-11-02T15:46:58.767335Z"},{"id":"OESA-2024-1762","title":"rubygem-activesupport security update","description":"A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing.\r\n\r\nSecurity Fix(es):\r\n\r\nAction Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.(CVE-2022-23633)","status":"published","published":"2024-06-28T11:07:13Z","modified":"2026-08-18T01:17:24.773776128Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1763","title":"rubygem-activesupport security update","description":"A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing.\r\n\r\nSecurity Fix(es):\r\n\r\nAction Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.(CVE-2022-23633)","status":"published","published":"2024-06-28T11:07:13Z","modified":"2026-08-18T01:17:25.517979334Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1764","title":"rubygem-activesupport security update","description":"A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing.\r\n\r\nSecurity Fix(es):\r\n\r\nAction Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.(CVE-2022-23633)","status":"published","published":"2024-06-28T11:07:13Z","modified":"2026-08-18T01:17:25.624731468Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1777","title":"rubygem-actionpack security update","description":"Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling easy unit/integration testing that doesn\u0026apos;t require a browser.\r\n\r\nSecurity Fix(es):\r\n\r\nAction Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.(CVE-2022-23633)","status":"published","published":"2024-06-28T11:07:14Z","modified":"2026-08-18T01:18:27.551993356Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1778","title":"rubygem-actionpack security update","description":"Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling easy unit/integration testing that doesn\u0026apos;t require a browser.\r\n\r\nSecurity Fix(es):\r\n\r\nAction Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.(CVE-2022-23633)","status":"published","published":"2024-06-28T11:07:14Z","modified":"2026-08-18T01:18:27.586603681Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1779","title":"rubygem-actionpack security update","description":"Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling easy unit/integration testing that doesn\u0026apos;t require a browser.\r\n\r\nSecurity Fix(es):\r\n\r\nAction Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.(CVE-2022-23633)","status":"published","published":"2024-06-28T11:07:14Z","modified":"2026-08-18T01:18:27.550990727Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1810","title":"rubygem-actionpack security update","description":"Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling easy unit/integration testing that doesn\u0026apos;t require a browser.\r\n\r\nSecurity Fix(es):\r\n\r\nAction Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.(CVE-2022-23633)","status":"published","published":"2024-07-05T11:07:16Z","modified":"2026-08-18T01:18:29.008730234Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"RHSA-2022:5498","title":"Red Hat Security Advisory: Satellite 6.11 Release","status":"published","published":"2024-09-29T19:06:23Z","modified":"2026-10-13T10:03:09Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"UBUNTU-CVE-2022-23633","description":"Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.","status":"published","published":"2022-02-11T21:15:00Z","modified":"2026-10-17T12:56:02.304197389Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"DLA-3093-1","title":"rails - security update","status":"published","published":"2022-09-03T00:00:00Z","modified":"2026-03-09T01:21:13.821056Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5372-1","title":"rails - security update","status":"published","published":"2023-03-13T00:00:00Z","modified":"2026-03-09T02:11:20.548457Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"openSUSE-SU-2024:11869-1","title":"ruby3.1-rubygem-actionpack-6.0-6.0.4.6-1.1 on GA media","description":"These are all security issues fixed in the ruby3.1-rubygem-actionpack-6.0-6.0.4.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:19:12.668503Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"openSUSE-SU-2024:11899-1","title":"ruby3.1-rubygem-actionpack-7.0-7.0.2.2-1.1 on GA media","description":"These are all security issues fixed in the ruby3.1-rubygem-actionpack-7.0-7.0.2.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:33:19.30285Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"openSUSE-SU-2024:12878-1","title":"ruby3.2-rubygem-actionpack-7.0-7.0.4.3-1.1 on GA media","description":"These are all security issues fixed in the ruby3.2-rubygem-actionpack-7.0-7.0.4.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:13:49.332383Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:14067-1","title":"ruby3.3-rubygem-actionpack-7.0-7.0.8.4-1.1 on GA media","description":"These are all security issues fixed in the ruby3.3-rubygem-actionpack-7.0-7.0.8.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-24T00:00:00Z","modified":"2026-02-04T04:00:08.348611Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2025:15110-1","title":"ruby3.4-rubygem-actionpack-7.0-7.0.8.6-1.3 on GA media","description":"These are all security issues fixed in the ruby3.4-rubygem-actionpack-7.0-7.0.8.6-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-17T00:00:00Z","modified":"2026-02-04T02:49:58.777457Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"RLSA-2022:5498","title":"Moderate: Satellite 6.11 Release","description":"Rocky Enterprise Software Foundation Satellite is a systems management tool for Linux-based\ninfrastructure. It allows for provisioning, remote management, and\nmonitoring of multiple Linux deployments with a single centralized tool.\n\nSecurity Fix(es):\n\n* libsolv: Heap-based buffer overflow in testcase_read() in src/testcase.c (CVE-2021-3200) \n* satellite: foreman: Authenticate remote code execution through Sendmail configuration (CVE-2021-3584)\n* candlepin: Allow unintended SCA certificate to authenticate Candlepin (CVE-2021-4142)\n* candlepin: netty: Information disclosure via the local system temporary directory (CVE-2021-21290)\n* candlepin: netty: Possible request smuggling in HTTP/2 due missing validation (CVE-2021-21295)\n* candlepin: netty: Request smuggling via content-length header (CVE-2021-21409)\n* tfm-rubygem-sidekiq: XSS via the queue name of the live-poll feature (CVE-2021-30151)\n* python-sqlparse: ReDoS via regular expression in StripComments filter (CVE-2021-32839)\n* libsolv: various flaws (CVE-2021-33928 CVE-2021-33929 CVE-2021-33930 CVE-2021-33938)\n* tfm-rubygem-puma: Inconsistent Interpretation of HTTP Requests in puma (CVE-2021-41136)\n* logback-classic: Remote code execution through JNDI call from within its configuration file (CVE-2021-42550)\n* candlepin: netty: Control chars in header names may lead to HTTP request smuggling (CVE-2021-43797)\n* python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through (CVE-2021-43818)\n* python3-django: Potential bypass of an upstream access control based on URL paths (CVE-2021-44420)  \n* libsolv: Heap overflow (CVE-2021-44568)\n* python3-django: Various flaws (CVE-2021-45115 CVE-2021-45116 CVE-2021-45452 CVE-2022-22818)\n* tfm-rubygem-actionpack: Information leak between requests (CVE-2022-23633)\n* tfm-rubygem-puma: rubygem-rails: Information leak between requests (CVE-2022-23634)\n* python3-django: Denial-of-service possibility in file uploads (CVE-2022-23833)\n* tfm-rubygem-sidekiq: WebUI Denial of Service caused by number of days on graph (CVE-2022-23837)\n* python3-django: Various flaws (CVE-2022-28346 CVE-2022-28347)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section.\n\nAdditional Changes:\n\n* New repo layout for Satellite, Utils, Maintenance, and Client repos.\n* Support for Rocky Linux 9 clients\n* Module-based installation on Rocky Linux 8\n* Upgrading Satellite Server and Capsule Server installations from Rocky Linux 7 to Rocky Linux 8\n* Connected and Disconnected servers supported on Rocky Linux 7 and Rocky Linux 8\n* Inter-Server Synchronization improvements\n* Puppet integration optional and disabled by default\n* Pulp 3 updated to Python 3.8\n* Change to Capsule certificate archive\n* New default port for communication with Rocky Enterprise Software Foundation Subscription Management * (RHSM) API on Capsule servers\n* New Content Views Page (Content Publication workflow simplification)\n* New Hosts Page (Technology Preview)\n* Registration and preview templates\n* Simplified host content source changing\n* Improved behavior for configuring and running remote jobs\n* Provisioning improvements\n* New error signaling unsupported options in TASK-Filter\n* Virt-who configuration enhanced to support Nutanix AHV\n* Cloud Connector configuration updated\n* Improved Insights adoption\n\nThe items above are not a complete list of changes. This update also fixes\nseveral bugs and adds various enhancements. Documentation for these changes\nis available from the Release Notes document linked to in the References\nsection.","status":"published","published":"2022-07-05T13:55:16Z","modified":"2026-02-05T04:30:12.09857Z","updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"SUSE-SU-2022:2108-1","title":"Security update for rubygem-actionpack-5_1, rubygem-activesupport-5_1","description":"This update for rubygem-actionpack-5_1 and rubygem-activesupport-5_1 fixes the following issues:\n\n- CVE-2021-22904: Fixed possible DoS Vulnerability in Action Controller Token Authentication (bsc#1185780)\n- CVE-2022-23633: Fixed possible exposure of information vulnerability in Action Pack (bsc#1196182)\n","status":"published","published":"2022-06-16T13:26:33Z","modified":"2026-02-04T03:07:13.513967Z","updated_at":"2026-11-02T15:53:50.513981Z"}]}}