{
  "cveId": "CVE-2022-23634",
  "url": "https://patchblox.com/security/cve/CVE-2022-23634",
  "summary": "CVE-2022-23634 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2022-23634, released February 11, 2022. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "puma: Puma is a Ruby/Rack web server built for parallelism",
  "description": "Puma is a Ruby/Rack web server built for parallelism. Prior to \u0060puma\u0060 version \u00605.6.2\u0060, \u0060puma\u0060 may not always call \u0060close\u0060 on the response body. Rails, prior to version \u00607.0.2.2\u0060, depended on the response body being closed in order for its \u0060CurrentAttributes\u0060 implementation to work correctly. The combination of these two behaviors (Puma not closing the body \u002B Rails\u0027 Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.",
  "published": "2022-02-11T14:15:00Z",
  "severity": "medium",
  "cvss": 5.9,
  "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss": 0.02107,
  "epssPercentile": 0.81865,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "libdb",
      "release": "rocky 8",
      "fixedVersion": "0:5.3.28-42.el8_4",
      "fix": "RLSA-2022:5498",
      "url": "https://patchblox.com/security/fix/linux/rlsa-2022-5498",
      "released": "2022-07-05T13:55:16Z"
    },
    {
      "platform": "linux",
      "product": "puma",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.6.4-1",
      "fix": "DEBIAN-CVE-2022-23634",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-23634",
      "released": "2022-02-11T22:15:07Z"
    },
    {
      "platform": "linux",
      "product": "puma",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.6.4-1",
      "fix": "DEBIAN-CVE-2022-23634",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-23634",
      "released": "2022-02-11T22:15:07Z"
    },
    {
      "platform": "linux",
      "product": "puma",
      "release": "Debian 14",
      "fixedVersion": "5.6.4-1",
      "fix": "DEBIAN-CVE-2022-23634",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-23634",
      "released": "2022-02-11T22:15:07Z"
    },
    {
      "platform": "linux",
      "product": "puma",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "3.12.4-1ubuntu2\u002Besm1",
      "fix": "puma 3.12.4-1ubuntu2\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-puma-3.12.4-1ubuntu2-esm1",
      "released": "2024-01-08T06:15:00Z"
    },
    {
      "platform": "linux",
      "product": "puma",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "5.5.2-2ubuntu2\u002Besm1",
      "fix": "puma 5.5.2-2ubuntu2\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-puma-5.5.2-2ubuntu2-esm1",
      "released": "2024-01-08T06:15:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}