Not rated
CVE-2021-22904 The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service…
Description
The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression. Impacted code uses `authenticate_or_request_with_http_token` or `authenticate_with_http_token` for request authentication.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| https://github.com/rails/rails | Versions not published |
References
- hackerone.com hackerone.com
- discuss.rubyonrails.org discuss.rubyonrails.org
- security.netapp.com security.netapp.com
Timeline
- Published
- Last modified
Other CVEs of https://github.com/rails/rails
The 27 CVEs of https://github.com/rails/rails →
CVE-2023-22794
A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments
Not rated
CVE-2023-22795
A regular expression based DoS vulnerability in Action…
Not rated
CVE-2023-22796
A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1
Not rated
CVE-2022-44566
A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1
7.5
High