The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Ca...
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2021-22880 rails Corrigé dans: 2:6.0.3.5+dfsg-1
- Ubuntu UBUNTU-CVE-2021-22880 rails
Description d'origine La description telle que publiée par la source (souvent en anglais).
The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the money type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory security.netapp.com
- advisory debian.org
- patch discuss.rubyonrails.org
- patch hackerone.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org