diff --git a/advisories/github-reviewed/2021/03/GHSA-8hc4-xxm3-5ppp/GHSA-8hc4-xxm3-5ppp.json b/advisories/github-reviewed/2021/03/GHSA-8hc4-xxm3-5ppp/GHSA-8hc4-xxm3-5ppp.json index 70ea79df985..9c751ad431b 100644 --- a/advisories/github-reviewed/2021/03/GHSA-8hc4-xxm3-5ppp/GHSA-8hc4-xxm3-5ppp.json +++ b/advisories/github-reviewed/2021/03/GHSA-8hc4-xxm3-5ppp/GHSA-8hc4-xxm3-5ppp.json @@ -1,12 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-8hc4-xxm3-5ppp", - "modified": "2023-03-14T00:18:27Z", + "modified": "2023-07-03T22:08:31Z", "published": "2021-03-02T03:44:14Z", "aliases": [ "CVE-2021-22880" ], - "summary": "Active Record subject to Regular Expression Denial-of-Service", + "summary": "Active Record subject to Regular Expression Denial-of-Service (ReDoS)", "details": "The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the `money` type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.", "severity": [ { @@ -95,6 +95,10 @@ "type": "WEB", "url": "https://discuss.rubyonrails.org/t/cve-2021-22880-possible-dos-vulnerability-in-active-record-postgresql-adapter/77129" }, + { + "type": "PACKAGE", + "url": "https://github.com/rails/rails/" + }, { "type": "WEB", "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2021-22880.yml"