Skip to content
Fencer Intel
high 8.0

CVE-2022-23634 json

Information Exposure when using Puma with Rails

published 4y ago modified 4mo ago also GHSA-rmj8-8hhh-gv5h , EUVD-2022-1175

cvss
8.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.1%
EPSS 2.1% chance of exploitation in 30 days, percentile 81%
public exploits
0
none known

Summary

Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.

Patch / fix

  • rubygems puma 4.3.11, 5.6.2
  • puma puma 4.3.11, 5.6.2
  • rubyonrails rails 5.2.6.2, 6.0.4.6, 6.1.4.6, 7.0.2.2
  • puma Debian 14, Debian 13, Debian 12 5.6.4-1

debian advisories DEBIAN-CVE-2022-23634

  • puma Ubuntu Pro 20.04 LTS 3.12.4-1ubuntu2+esm1
  • puma Ubuntu Pro 22.04 LTS 5.5.2-2ubuntu2+esm1

ubuntu advisories UBUNTU-CVE-2022-23634

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • foreman satellite utils 6.11, satellite capsule 6.11, satellite 6.11 3.1.1.21-2.el7sat
  • foreman satellite utils 6.11, satellite capsule 6.11, satellite 6.11 3.1.1.21-2.el8sat
  • libsolv satellite capsule 6.11, satellite 6.11 0.7.22-1.el7pc
  • libsolv satellite capsule 6.11, satellite 6.11 0.7.22-1.el8pc
  • candlepin satellite 6.11 4.1.13-1.el7sat
  • candlepin satellite 6.11 4.1.13-1.el8sat
  • satellite satellite utils 6.11, satellite capsule 6.11, satellite 6.11 6.11.0-2.el7sat
  • satellite satellite utils 6.11, satellite capsule 6.11, satellite 6.11 6.11.0-2.el8sat

red hat advisories RHSA-2022:5498

  • rubygem-puma SLE High Availability Extension 15 SP3, SLE High Availability Extension 15 SP2, SLE High Availability Extension 15 SP1 +3 more 4.3.11-150000.3.6.2

suse advisories SUSE-SU-2022:1515-1

  • rubygem-puma openSUSE Tumbleweed 6.4.3-1.5
  • rubygem-puma openSUSE Tumbleweed 6.4.3-1.3
  • rubygem-puma openSUSE Tumbleweed 5.6.2-1.1
  • ruby3.2-rubygem-puma openSUSE Tumbleweed 6.0.0-2.1
  • rubygem-puma openSUSE Tumbleweed 6.4.2-1.1

opensuse advisories openSUSE-SU-2026:10357-1openSUSE-SU-2025:15123-1openSUSE-SU-2024:11847-1openSUSE-SU-2024:12900-1openSUSE-SU-2024:13720-1

  • libdb Rocky Linux 8 5.3.28-42.el8_4

rocky linux advisories RLSA-2022:5498

  • ruby-puma Arch Linux 5.6.4-1

arch linux advisories AVG-2764

Is CVE-2022-23634 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-23634 updated cvss 8.0

rubygem-puma: rubygem-rails: information leak between requests

  • Red Hat CloudForms Management Engine 5 rubygem-puma, rubygem-rails
    affected: no fix planned “Will not fix”
  • Red Hat Satellite 6 tfm-rubygem-rails
    affected: no fix available
  • Red Hat Satellite 6.11 for RHEL 7 tfm-rubygem-puma 5.6.2-1.el7sat Red Hat Satellite 6.11 for RHEL 8 rubygem-puma 5.6.2-1.el8sat
    fixed: vendor fix RHSA-2022:5498
  • Red Hat Satellite 6.11 for RHEL 7 tfm 7.0-1.el7sat, gofer 2.12.5-7.el7sat, katello 4.3.0-3.el7sat, libsolv 0.7.22-1.el7pc, libcomps 0.1.18-1.el7pc, libsolv0 0.6.34-4.el7sat, +637 more Red Hat Satellite 6.11 for RHEL 8 libdb 5.3.28-42.el8_4, katello 4.3.0-3.el8sat, libsolv 0.7.22-1.el8pc, libcomps 0.1.18-1.el8pc, python-idna 3.3-1.el8pc, python-pbr 5.6.0-1.el8pc, +628 more Red Hat Storage 3 rubygem-puma
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
last yr.

Exploit prediction

2.11% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 8.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
NVD 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N
GitHub 3.1 8.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
rubygems puma
>=5.0.0, <5.6.2
<4.3.11
5.6.2
4.3.11

Affected products

  • puma puma

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-404 Improper Resource Shutdown or Release
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.