Skip to content
OpenAdvisories
High · 7.5 Public exploit CVE-2021-22880 EUVD-2021-0633GHSA-8hc4-xxm3-5ppp

Active Record subject to Regular Expression Denial-of-Service (ReDoS)

Published Feb 11, 2021 · Updated Aug 3, 2024 · Assigned by hackerone

Package: activerecord Package: rails Package: rails Ecosystem: Debian Ecosystem: RubyGems Ecosystem: Ubuntu

Description

The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the `money` type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.

Affected products

VendorProductAffectedFixed
— https://github.com/rails/rails Fixed in 6.1.2.1, 6.0.3.5, 5.2.4.5 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 rails 2:6.0.3.5+dfsg-1 —
Debian 13 rails 2:6.0.3.5+dfsg-1 —
Debian 12 rails 2:6.0.3.5+dfsg-1 —
Debian 10 rails 2:5.2.2.1+dfsg-1+deb10u3 DSA-4929-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 rails No fix yet —
Ubuntu 26.04 LTS rails No fix yet —
Ubuntu 25.10 rails No fix yet —
Ubuntu 24.04 LTS rails No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS rails No fix yet —
Ubuntu Pro 20.04 LTS rails No fix yet —
Ubuntu Pro 18.04 LTS rails No fix yet —
Ubuntu Pro 16.04 LTS rails No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP3 rubygem-activerecord-5_1 5.1.4-5.3.3 SUSE-SU-2021:3634-1
SLES 15 SP2 rubygem-activerecord-5_1 5.1.4-5.3.3 SUSE-SU-2021:3634-1
SLES 15 SP1 rubygem-activerecord-5_1 5.1.4-5.3.3 SUSE-SU-2021:3634-1
SLES 15 rubygem-activerecord-5_1 5.1.4-5.3.3 SUSE-SU-2021:3634-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE OpenStack Cloud Crowbar 9 rubygem-activerecord-4_2 4.2.9-6.6.1 SUSE-SU-2021:3267-1
SUSE OpenStack Cloud Crowbar 8 rubygem-activerecord-4_2 4.2.9-6.6.1 SUSE-SU-2021:3267-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed rubygem-activerecord-6.0 6.0.4.4-1.1 openSUSE-SU-2024:11826-1
openSUSE Leap 15.3 rubygem-activerecord-5_1 5.1.4-5.3.3 openSUSE-SU-2021:3634-1
openSUSE Leap 15.2 rubygem-activerecord-5_1 5.1.4-lp152.4.3.1 openSUSE-SU-2021:1468-1

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems activerecord >= 5.0.0, < 5.2.4.5 5.2.4.5 GHSA-8hc4-xxm3-5ppp
RubyGems activerecord >= 6.0.0, < 6.0.3.5 6.0.3.5 GHSA-8hc4-xxm3-5ppp
RubyGems activerecord >= 6.1.0, < 6.1.2.1 6.1.2.1 GHSA-8hc4-xxm3-5ppp

Advisories 6

References