CVE-2021-22880: Input Validation
The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the money type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-22880?
CVE-2021-22880 is a regular expression denial of service (REDoS) vulnerability in the PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5.
What is the severity of CVE-2021-22880?
CVE-2021-22880 has a severity score of 7.5 (high).
Which software versions are affected by CVE-2021-22880?
CVE-2021-22880 affects Rails versions 5.2.4.5, 6.0.3.5, 6.1.2.1, and earlier.
How can I fix the CVE-2021-22880 vulnerability?
To fix the CVE-2021-22880 vulnerability, upgrade to Active Record versions 5.2.2.1+dfsg-1+deb10u3, 6.0.3.7+dfsg-2+deb11u2, 6.1.7.3+dfsg-1, or 6.1.7.3+dfsg-2.
Where can I find more information about CVE-2021-22880?
You can find more information about CVE-2021-22880 at the following references: [link1](https://discuss.rubyonrails.org/t/cve-2021-22880-possible-dos-vulnerability-in-active-record-postgresql-adapter/77129), [link2](https://hackerone.com/reports/1023899), [link3](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MO5OJ3F4ZL3UXVLJO6ECANRVZBNRS2IH/).