{"id":"CVE-2022-23634","published":"2022-02-11T21:40:11Z","modified":"2025-04-23T19:05:33Z","title":"Information Exposure when using Puma with Rails","vendor":"puma","product":"puma","tier":"tail","description":{"text":"Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.","provenance":"source","from":"CVE.org"},"cvss":{"score":8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.02107,"percentile":0.8176,"provenance":"source"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"references":[{"url":"https://github.com/puma/puma/security/advisories/GHSA-rmj8-8hhh-gv5h","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/puma/puma/commit/b70f451fe8abc0cff192c065d549778452e155bb","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-rmj8-8hhh-gv5h","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-wh98-p28r-vrc9","tags":["x_refsource_MISC"]},{"url":"https://groups.google.com/g/ruby-security-ann/c/FkTM-_7zSNA/m/K2RiMJBlBAAJ?utm_medium=email&utm_source=footer&pli=1","tags":["x_refsource_MISC"]},{"url":"https://www.debian.org/security/2022/dsa-5146","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/05/msg00034.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://security.gentoo.org/glsa/202208-28","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/08/msg00015.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TUBFJ44NCKJ34LECZRAP4N5VL6USJSIB/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7NESIBFCNSR3XH7LXDPKVMSUBNUB43G/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6YWGIIKL7KKTS3ZOAYMYPC7D6WQ5OA5/","tags":["vendor-advisory","x_refsource_FEDORA"]}],"priority":{"score":22.0,"factors":[{"name":"EPSS percentile","points":16.35},{"name":"CVSS severity","points":5.6}]},"vendorSlug":"puma","affectedVersions":[{"vendor":"puma","product":"puma","versions":[">= 5.0.0, < 5.6.2","< 4.3.11"]}],"affected":[{"ecosystem":"RubyGems","package":"puma","vulnerableRanges":[">=5.0.0, <5.6.2","<4.3.11"],"patched":["5.6.2","4.3.11"],"from":["GHSA-rmj8-8hhh-gv5h"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-1175","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-rails-cve-2022-23633","parents":[{"from":"CVE-2022-23633","to":"CVE-2022-23634","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-wh98-p28r-vrc9","via":"related"},{"kind":"osv-related","provenance":"source","id":"GHSA-rmj8-8hhh-gv5h","via":"reference","url":"https://github.com/advisories/GHSA-wh98-p28r-vrc9"}]}],"packageHistory":[{"cve":"CVE-2020-11077","published":"2020-05-22","fixed":"4.3.5","kev":false},{"cve":"CVE-2021-29509","published":"2021-05-11","fixed":"5.3.1","kev":false},{"cve":"CVE-2021-41136","published":"2021-10-12","fixed":"5.5.1","kev":false,"link":{"from":"CVE-2021-41136","to":"CVE-2022-23634","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:puma","fromFixed":"5.5.1","toFixed":"5.6.2","daysApart":122},{"kind":"version-step","provenance":"source","package":"RubyGems:puma","fromFixed":"4.3.9","toFixed":"4.3.11","daysApart":122}]}},{"cve":"CVE-2022-23634","published":"2022-02-11","fixed":"5.6.2","kev":false},{"cve":"CVE-2022-24790","published":"2022-03-30","fixed":"5.6.4","kev":false,"link":{"from":"CVE-2022-23634","to":"CVE-2022-24790","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:puma","fromFixed":"5.6.2","toFixed":"5.6.4","daysApart":47},{"kind":"version-step","provenance":"source","package":"RubyGems:puma","fromFixed":"4.3.11","toFixed":"4.3.12","daysApart":47}]}},{"cve":"CVE-2023-40175","published":"2023-08-18","fixed":"6.3.1","kev":false},{"cve":"CVE-2024-21647","published":"2024-01-08","fixed":"6.4.2","kev":false}],"package":"RubyGems:puma"}}