Bug 1930102 (CVE-2021-22880)

Summary: CVE-2021-22880 rubygem-activerecord: crafted input may cause a regular expression DoS
Product: [Other] Security Response Reporter: Marian Rehak <mrehak>
Component: vulnerabilityAssignee: Nobody <nobody>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akarol, amackenz, amasferr, bbuckingham, bcourt, bkearney, chazlett, dmetzger, gmccullo, gtanzill, hhudgeon, jaruga, jhardy, lzap, mkudlej, mo, mtasaka, nmoumoul, pcreech, pvalena, rchan, rhel8-maint, rjerrido, ruby-packagers-sig, simaishi, smallamp, sokeeffe, sseago, strzibny, tjochec, vondruch
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: rubygem-activerecord 6.1.2.1, rubygem-activerecord 6.0.3.5, rubygem-activerecord 5.2.4.5 Doc Type: If docs needed, set a value
Doc Text:
The PostgreSQL adapter in Active Record suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the `money` type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1930103, 1931366, 1932282, 1932300, 1932301    
Bug Blocks: 1930104, 1997390    

Description Marian Rehak 2021-02-18 11:17:55 UTC 
The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the `money` type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.

Upstream Reference:

https://discuss.rubyonrails.org/t/cve-2021-22880-possible-dos-vulnerability-in-active-record-postgresql-adapter/77129
Comment 1 Marian Rehak 2021-02-18 11:19:52 UTC 
Created rubygem-activerecord tracking bugs for this issue:

Affects: fedora-all [bug 1930103]
Comment 3 Yadnyawalk Tale 2021-02-22 11:43:30 UTC 
Hackerone's report: https://hackerone.com/reports/1023899
Comment 4 Yadnyawalk Tale 2021-02-22 11:48:26 UTC 
Upstream patches: 
6-1-stable: https://github.com/rails/rails/commit/536503dffe1af707501d7744c575579269e5c373
6-0-stable: https://github.com/rails/rails/commit/879d02107b5b3eb7aeaad1cd1f259bb41f17286b
5-2-stable: https://github.com/rails/rails/commit/bf0ef9df1793046241c26b3fb92fac551d1628b4
Comment 5 Yadnyawalk Tale 2021-02-22 11:48:32 UTC 
External References:

https://discuss.rubyonrails.org/t/cve-2021-22880-possible-dos-vulnerability-in-active-record-postgresql-adapter/77129
Comment 9 Yadnyawalk Tale 2021-02-24 13:20:48 UTC 
Statement:

Red Hat Satellite ship affected version of rubygem-activerecord however, the product is not vulnerable to the flaw as it does not use the `money` field type in product code. We may update the rubygem-activerecord dependency in a future release.
Comment 21 timpowellcd 2023-10-30 21:25:22 UTC Comment hidden (spam)