CVE-2021-22902
rails: Possible Denial of Service vulnerability in Action Dispatch
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible denial of service vulnerability in the Mime type parser of Action Dispatch. Carefully crafted Accept headers can cause the mime type parser in Action Dispatch to do catastrophic backtracking in the regular expression engine.
El actionpack ruby gem (un marco de trabajo para manejar y responder a peticiones web en Rails) versiones anteriores a 6.0.3.7, 6.1.3.2 sufre de una posible vulnerabilidad de denegación de servicio en el analizador de tipos Mime de Action Dispatch. Unas cabeceras Accept cuidadosamente diseñadas pueden hacer que el analizador de tipos mime de Action Dispatch realice un retroceso catastrófico en el motor de expresiones regulares
A flaw was found in RubyGem Actionpack which is framework for handling and responding to web requests in Rails. A possible Denial of Service vulnerability was found in the Mime type parser of Action Dispatch.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-01-06 CVE Reserved
- 2021-06-11 CVE Published
- 2024-02-25 EPSS Updated
- 2024-08-03 CVE Updated
- 2024-08-03 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-400: Uncontrolled Resource Consumption
CAPEC
References (3)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://discuss.rubyonrails.org/t/cve-2021-22902-possible-denial-of-service-vulnerability-in-action-dispatch/77866 | 2024-08-03 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2021-22902 | 2021-11-16 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1961382 | 2021-11-16 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | >= 6.0.0 < 6.0.3.7 Search vendor "Rubyonrails" for product "Rails" and version " >= 6.0.0 < 6.0.3.7" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | >= 6.1.0 < 6.1.0.2 Search vendor "Rubyonrails" for product "Rails" and version " >= 6.1.0 < 6.1.0.2" | - |
Affected
| ||||||