Skip to content
OpenAdvisories
High DSA-4929-1 3 CVEs

rails - security update

Published Jun 9, 2021 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 10 rails 2:5.2.2.1+dfsg-1+deb10u3

Vulnerabilities 3

  • High 7.5
    CVE-2021-22880 Public exploit

    Active Record subject to Regular Expression Denial-of-Service (ReDoS)

    The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the `money` type of the PostgreSQL adapter in Active …

    rails rails activerecord Debian Ubuntu RubyGems
  • High 7.5
    CVE-2021-22885

    Action Pack contains Information Disclosure / Unintended Method Execution vulnerability

    A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper with untrusted user input.

    rails actionpack rails Debian Ubuntu RubyGems
  • High 7.5
    CVE-2021-22904

    Possible DoS Vulnerability in Action Controller Token Authentication

    The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression. Impacted code uses `authenticate_or_requ…

    rails actionpack rails Debian Ubuntu RubyGems