HIGH
rubygem-activerecord: Denial of Service
Published Feb 9, 2023
7.5
HIGHCVSS 3.1
EPSS 1.26%
Description
A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1. When a value outside the range for a 64bit signed integer is provided to the PostgreSQL connection adapter, it will treat the target column type as numeric. Comparing integer values against numeric values can result in a slow sequential scan resulting in potential Denial of Service.
Affected products
No data.
OR
- < 6.1.7.1
- ≥ 7.0.0 · < 7.0.4.1
No data.
Red Hat Satellite 6.14 for RHEL 8
rubygem-activerecord-0:6.1.7.3-1.el8sat
Fixed · RHSA-2023:6818
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Satellite 6.14 for RHEL 8 | rubygem-activerecord-0:6.1.7.3-1.el8sat | Fixed | RHSA-2023:6818 |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (16)
- https://access.redhat.com/security/cve/CVE-2022-44566 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2164789 Issue Tracking
- https://code.jeremyevans.net/2022-11-01-forcing-sequential-scans-on-postgresql.html ExploitMitigationThird Party Advisory
- https://discuss.rubyonrails.org/t/cve-2022-44566-possible-denial-of-service-vulnerability-in-activerecords-postgresql-adapter/82119 PatchVendor Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-0336 Advisory
- https://github.com/advisories/GHSA-579w-22j4-4749 Advisory
- https://github.com/rails/rails/commit/4f44aa9d514e701ada92b5cf08beccf566eeaebf
- https://github.com/rails/rails/commit/82bcdc011e2ff674e7dd8fd8cee3a831c908d29b
- https://github.com/rails/rails/releases/tag/v6.1.7.1
- https://github.com/rails/rails/releases/tag/v7.0.4.1
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2022-44566.yml
- https://mailchi.mp/railslts/rails-lts-multiple-dos-vulnerabilities-in-rails-rack-and-globalid
- https://makandracards.com/railslts/508019-rails-5-2-lts-changelog#section-jan-20th-2023-rails-version-5-2-8-15
- https://nvd.nist.gov/vuln/detail/CVE-2022-44566
- https://rubyonrails.org/2023/1/17/Rails-Versions-6-0-6-1-6-1-7-1-7-0-4-1-have-been-released
- https://www.cve.org/CVERecord?id=CVE-2022-44566
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner hackerone
Published Feb 9, 2023
Updated Mar 25, 2025
Reserved Nov 1, 2022
Link CVE-2022-44566
CISA Vulnrichment
Updated Mar 25, 2025
GitHub
Link GHSA-579W-22J4-4749