CVE-2021-22902
published 2021-06-11CVE-2021-22902: The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible denial of service…
PriorityP338high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
2.79%
84.9th percentile
The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible denial of service vulnerability in the Mime type parser of Action Dispatch. Carefully crafted Accept headers can cause the mime type parser in Action Dispatch to do catastrophic backtracking in the regular expression engine.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| actionpack_project | actionpack | >= 6.0.0 < 6.0.3.7 | 6.0.3.7 |
| actionpack_project | actionpack | >= 6.1.0 < 6.1.3.2 | 6.1.3.2 |
| debian | rails | < rails 2:6.0.3.7+dfsg-1 (bookworm) | rails 2:6.0.3.7+dfsg-1 (bookworm) |
| https | github.com_rails_rails | — | — |
| rubyonrails | rails | >= 0 < 2:6.0.3.7+dfsg-1 | 2:6.0.3.7+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:6.0.3.7+dfsg-1 | 2:6.0.3.7+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:6.0.3.7+dfsg-1 | 2:6.0.3.7+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:6.0.3.7+dfsg-1 | 2:6.0.3.7+dfsg-1 |
| rubyonrails | rails | >= 6.0.0 < 6.0.3.7 | 6.0.3.7 |
| rubyonrails | rails | >= 6.1.0 < 6.1.0.2 | 6.1.0.2 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2021-22902: The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6
osv·2021-06-11·CVSS 7.5
CVE-2021-22902 [HIGH] CVE-2021-22902: The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6
The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible denial of service vulnerability in the Mime type parser of Action Dispatch. Carefully crafted Accept headers can cause the mime type parser in Action Dispatch to do catastrophic backtracking in the regular expression engine.
OSV
Denial of Service in Action Dispatch
osv·2021-05-05
CVE-2021-22902 [HIGH] Denial of Service in Action Dispatch
Denial of Service in Action Dispatch
Impact
There is a possible Denial of Service vulnerability in Action Dispatch. Carefully crafted Accept headers can cause the mime type parser in Action Dispatch to do catastrophic backtracking in the regular expression engine.
Releases
The fixed releases are available at the normal locations.
Workarounds
The following monkey patch placed in an initializer can be used to work around the issue.
```ruby
module Mime
class Type
MIME_REGEXP = /\A(?:\*\/\*|#{MIME_NAME}\/(?:\*|#{MIME_NAME})(?>\s*#{MIME_PARAMETER}\s*)*)\z/
end
end
```
Patches
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
* 6-0-Prevent-catastrophic-backtracking-
GHSA
Denial of Service in Action Dispatch
ghsa·2021-05-05
CVE-2021-22902 [HIGH] CWE-400 Denial of Service in Action Dispatch
Denial of Service in Action Dispatch
Impact
There is a possible Denial of Service vulnerability in Action Dispatch. Carefully crafted Accept headers can cause the mime type parser in Action Dispatch to do catastrophic backtracking in the regular expression engine.
Releases
The fixed releases are available at the normal locations.
Workarounds
The following monkey patch placed in an initializer can be used to work around the issue.
```ruby
module Mime
class Type
MIME_REGEXP = /\A(?:\*\/\*|#{MIME_NAME}\/(?:\*|#{MIME_NAME})(?>\s*#{MIME_PARAMETER}\s*)*)\z/
end
end
```
Patches
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
* 6-0-Prevent-catastrophic-backtracking-
Red Hat
rails: Possible Denial of Service vulnerability in Action Dispatch
vendor_redhat·2021-05-05·CVSS 7.5
CVE-2021-22902 [HIGH] CWE-400 rails: Possible Denial of Service vulnerability in Action Dispatch
rails: Possible Denial of Service vulnerability in Action Dispatch
The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible denial of service vulnerability in the Mime type parser of Action Dispatch. Carefully crafted Accept headers can cause the mime type parser in Action Dispatch to do catastrophic backtracking in the regular expression engine.
A flaw was found in RubyGem Actionpack which is framework for handling and responding to web requests in Rails. A possible Denial of Service vulnerability was found in the Mime type parser of Action Dispatch.
Package: cfme-gemset (CloudForms Management Engine 5) - Not affected
Package: tfm-ror52-rubygem-actionpack (Red Hat Satellite 6) - Not affected
Debian
CVE-2021-22902: rails - The actionpack ruby gem (a framework for handling and responding to web requests...
vendor_debian·2021·CVSS 7.5
CVE-2021-22902 [HIGH] CVE-2021-22902: rails - The actionpack ruby gem (a framework for handling and responding to web requests...
The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible denial of service vulnerability in the Mime type parser of Action Dispatch. Carefully crafted Accept headers can cause the mime type parser in Action Dispatch to do catastrophic backtracking in the regular expression engine.
Scope: local
bookworm: resolved (fixed in 2:6.0.3.7+dfsg-1)
bullseye: resolved (fixed in 2:6.0.3.7+dfsg-1)
forky: resolved (fixed in 2:6.0.3.7+dfsg-1)
sid: resolved (fixed in 2:6.0.3.7+dfsg-1)
trixie: resolved (fixed in 2:6.0.3.7+dfsg-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://discuss.rubyonrails.org/t/cve-2021-22902-possible-denial-of-service-vulnerability-in-action-dispatch/77866https://hackerone.com/reports/1138654https://discuss.rubyonrails.org/t/cve-2021-22902-possible-denial-of-service-vulnerability-in-action-dispatch/77866https://hackerone.com/reports/1138654
2021-06-11
Published