CVE-2022-44566: High severity Activerecord Project Activerecord Ruby vulnerability
A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1. When a value outside the range for a 64bit signed integer is provided to the PostgreSQL connection adapter, it will treat the target column type as numeric. Comparing integer values against numeric values can result in a slow sequential scan resulting in potential Denial of Service.
Other sources
In ActiveRecord <7.0.4.1 and <6.1.7.1, when a value outside the range for a 64bit signed integer is provided to the PostgreSQL connection adapter, it will treat the target column type as numeric. Comparing integer values against numeric values can result in a slow sequential scan resulting in potential Denial of Service.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/activerecordto a version that resolves this vulnerability.Fixed in 6.1.7.1 - Upgrade
Upgrade
rubygems/activerecordto a version that resolves this vulnerability.Fixed in 7.0.4.1 - Upgrade
Upgrade
redhat/rubygem-activerecordto a version that resolves this vulnerability.Fixed in 6.1.7.1 - Upgrade
Upgrade
redhat/rubygem-activerecordto a version that resolves this vulnerability.Fixed in 7.0.4.1 - Upgrade
Upgrade
debian/railsto a version that resolves this vulnerability.Fixed in 2:6.1.7.10+dfsg-1~deb12u2Fixed in 2:6.1.7.10+dfsg-1~deb12u3Fixed in 2:7.2.2.2+dfsg-2~deb13u1Fixed in 2:7.2.2.2+dfsg-2~deb13u2Fixed in 2:7.2.4+dfsg-1Fixed in 2:7.2.4+dfsg-2 - Upgrade
Upgrade
debian/railsto a version that resolves this vulnerability.Fixed in 2:6.1.7.3+dfsg-1 - Upgrade
Upgrade
ActiveRecord PostgreSQL adapterto a version that resolves this vulnerability.Fixed in 5.2.8.15 - Upgrade
Upgrade
ActiveRecord PostgreSQL adapterto a version that resolves this vulnerability.Fixed in 6.1.7.1 - Upgrade
Upgrade
ActiveRecord PostgreSQL adapterto a version that resolves this vulnerability.Fixed in 7.0.4.1 - Compensating control
Ensure user-supplied input provided to ActiveRecord clauses does not contain integers wider than a signed 64-bit representation or floats.
Event History
Frequently Asked Questions
What is the severity of CVE-2022-44566?
CVE-2022-44566 is classified as a denial of service vulnerability which can cause interruptions in service.
How do I fix CVE-2022-44566?
To mitigate CVE-2022-44566, upgrade ActiveRecord to version 6.1.7.1 or 7.0.4.1 or later.
What software versions are affected by CVE-2022-44566?
CVE-2022-44566 affects ActiveRecord versions prior to 6.1.7.1 and 7.0.4.1.
What kind of attack does CVE-2022-44566 facilitate?
CVE-2022-44566 can be exploited to launch a denial of service attack on services using the affected ActiveRecord versions.
Is there a known workaround for CVE-2022-44566?
There are no known workarounds for CVE-2022-44566; the only solution is to apply the appropriate upgrade.