Input validation error in Ruby on Rails - CVE-2022-44566

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU71305

Input validation error in Ruby on Rails - CVE-2022-44566

Published: January 18, 2023


Vulnerability identifier: #VU71305
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-44566
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in ActiveRecord’s PostgreSQL adapter. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.


Affected software

Ruby on Rails
SUSE Linux Enterprise High Availability Extension 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Server 15 SP1 Business Critical Linux
SUSE Linux Enterprise Server 15 SP2 Business Critical Linux
SUSE Linux Enterprise Server 15 SP3 Business Critical Linux
openSUSE Leap
openEuler
Fedora
ruby2.1-rubygem-activerecord-4_2
ruby2.5-rubygem-activerecord-5_1
rubygem-activerecord
rubygem-activerecord-doc
rubygem-actioncable-7.0.4.2-1.fc38 rubygem-actionmailbox-7.0.4.2-1.fc38 rubygem-actionmailer-7.0.4.2-1.fc38 rubygem-actionpack-7.0.4.2-1.fc38 rubygem-actiontext-7.0.4.2-1.fc38 rubygem-actionview-7.0.4.2-1.fc38 rubygem-activejob-7.0.4.2-1.fc38 rubygem-acti
Red Hat Satellite

How to mitigate CVE-2022-44566

Install updates from vendor's website.

Ruby on Rails - addressed in versions 6.1.7.1, 7.0.4.1
ruby2.1-rubygem-activerecord-4_2 - addressed in versions 4.2.9-6.9.1, 4.2.9-6.12.1
ruby2.5-rubygem-activerecord-5_1 - update to 5.1.4-150000.5.6.1
rubygem-activerecord - update to 6.1.4.1-2
rubygem-activerecord-doc - update to 6.1.4.1-2
Red Hat Satellite - update to 6.14
rubygem-actioncable-7.0.4.2-1.fc38 rubygem-actionmailbox-7.0.4.2-1.fc38 rubygem-actionmailer-7.0.4.2-1.fc38 rubygem-actionpack-7.0.4.2-1.fc38 rubygem-actiontext-7.0.4.2-1.fc38 rubygem-actionview-7.0.4.2-1.fc38 rubygem-activejob-7.0.4.2-1.fc38 rubygem-acti - update to 7.0.4.2-1.fc38

External References

Related Security Bulletins