The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Ca...
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2021-22880 rails 修正版: 2:6.0.3.5+dfsg-1
- Ubuntu UBUNTU-CVE-2021-22880 rails
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the money type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory security.netapp.com
- advisory debian.org
- patch discuss.rubyonrails.org
- patch hackerone.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org