CVE-2022-23633

A flaw was found in the Rack middleware package of RubyGems, where response bodies will not close under certain circumstances. This flaw allows an attacker to iterate requests to force ActionDispatch::Executor to not close, allowing subsequent requests to leak data from ActiveSupport::CurrentAttributes.

Mitigation

A workaround for this problem:

class GuardedExecutor < ActionDispatch::Executor  
  def call(env)  
    ensure_completed!  
    super  
  end  
  
  private  
  
    def ensure_completed!  
      @executor.new.complete! if @executor.active?  
    end  
end  
  
# Ensure the guard is inserted before ActionDispatch::Executor  
Rails.application.configure do  
  config.middleware.swap ActionDispatch::Executor, GuardedExecutor, executor  
end