Incorrect Regular Expression in Ruby on Rails - CVE-2021-22880

Vulnerability identifier: #VU50606

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-22880

CWE-ID: CWE-185

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect regular expression for money processing format in the PostgreSQL adapter. A remote attacker can pass specially crafted input to the application and perform a regular expression denial of service (ReDOS) attack.

Ruby on Rails
rails (Debian package)
ruby2.5-rubygem-activerecord-5_1
rubygem-activerecord
rubygem-actionpack
OpenStack Cloud Crowbar
SUSE Linux Enterprise High Availability
Fedora

Install updates from vendor's website.

Ruby on Rails - addressed in versions 5.2.4.5, 6.0.3.5, 6.1.2.1
rails (Debian package) - update to 2:5.2.2.1+dfsg-1+deb10u3
ruby2.5-rubygem-activerecord-5_1 - update to 5.1.4-5.3.3
rubygem-activerecord - addressed in versions 5.2.3-5.fc32, 6.0.3.4-2.fc33
rubygem-actionpack - update to 6.0.3.4-2.fc33

• https://github.com/rails/rails/releases/tag/v6.1.2.1
• https://github.com/rails/rails/releases/tag/v6.0.3.5
• https://github.com/rails/rails/releases/tag/v5.2.4.5

• Multiple vulnerabilities in Ruby on Rails
• Debian update for rails
• SUSE OpenStack Cloud Crowbar update for rubygem-activerecord
• SUSE update for rubygem-activerecord-5_1
• Fedora 33 update for rubygem-actionpack, rubygem-activerecord
• Fedora 32 update for rubygem-activerecord