The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the `money` type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input. Upstream Reference: https://discuss.rubyonrails.org/t/cve-2021-22880-possible-dos-vulnerability-in-active-record-postgresql-adapter/77129
Created rubygem-activerecord tracking bugs for this issue: Affects: fedora-all [bug 1930103]
Hackerone's report: https://hackerone.com/reports/1023899
Upstream patches: 6-1-stable: https://github.com/rails/rails/commit/536503dffe1af707501d7744c575579269e5c373 6-0-stable: https://github.com/rails/rails/commit/879d02107b5b3eb7aeaad1cd1f259bb41f17286b 5-2-stable: https://github.com/rails/rails/commit/bf0ef9df1793046241c26b3fb92fac551d1628b4
External References: https://discuss.rubyonrails.org/t/cve-2021-22880-possible-dos-vulnerability-in-active-record-postgresql-adapter/77129
Statement: Red Hat Satellite ship affected version of rubygem-activerecord however, the product is not vulnerable to the flaw as it does not use the `money` field type in product code. We may update the rubygem-activerecord dependency in a future release.
This comment was flagged a spam, view the edit history to see the original text if required.