Regular Expression Denial of Service in PostgreSQL Adapter for Active Record
CVE-2021-22880

7.5HIGH

Key Information:

Vendor: Rubyonrails
Status: Https://github.com/rails/rails
Vendor: CVE Published:; 11 February 2021

🔔 Create Rubyonrails Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2021-22880?

The PostgreSQL adapter in Active Record, prior to specific versions, is susceptible to a regular expression denial of service (REDoS) vulnerability. This issue arises when tailored input leads the input validation mechanism concerning the 'money' type columns in PostgreSQL to consume excessive processing time due to inefficient regular expressions. As a result, this can expose Rails applications to denial of service attacks, particularly when handling user input, emphasizing the importance of updating to secure versions to mitigate risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

https://github.com/rails/rails Fixed in 6.1.2.1, 6.0.3.5, 5.2.4.5

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2021-22880
Created by halkichi0308