CVE-2021-22880

HIGH7.5EPSS 2.6%

Active Record subject to Regular Expression Denial-of-Service (ReDoS)

發布日:2021/3/2修改日:2026/4/28
也稱為:GHSA-8hc4-xxm3-5pppDEBIAN-CVE-2021-22880

描述

The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the `money` type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.

受影響套件(3)

CVSS 分數

來源版本嚴重程度向量
osvCVSS 3.1HIGH7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

參考連結(11)