gsd-2021-22902
Vulnerability from gsd
Modified
2021-05-05 00:00
Details
There is a possible Denial of Service vulnerability in the Mime type parser of
Action Dispatch. This vulnerability has been assigned the CVE identifier
CVE-2021-22902.
Versions Affected: >= 6.0.0
Not affected: < 6.0.0
Fixed Versions: 6.0.3.7, 6.1.3.2
Impact
------
There is a possible Denial of Service vulnerability in Action Dispatch.
Carefully crafted Accept headers can cause the mime type parser in Action
Dispatch to do catastrophic backtracking in the regular expression engine.
Workarounds
-----------
The following monkey patch placed in an initializer can be used to work around
the issue:
```ruby
module Mime
class Type
MIME_REGEXP = /\A(?:\*\/\*|#{MIME_NAME}\/(?:\*|#{MIME_NAME})(?>\s*#{MIME_PARAMETER}\s*)*)\z/
end
end
```
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2021-22902",
"description": "The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible denial of service vulnerability in the Mime type parser of Action Dispatch. Carefully crafted Accept headers can cause the mime type parser in Action Dispatch to do catastrophic backtracking in the regular expression engine.",
"id": "GSD-2021-22902",
"references": [
"https://www.suse.com/security/cve/CVE-2021-22902.html",
"https://access.redhat.com/errata/RHSA-2021:4702",
"https://security.archlinux.org/CVE-2021-22902"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "actionpack",
"purl": "pkg:gem/actionpack"
}
}
],
"aliases": [
"CVE-2021-22902",
"GHSA-g8ww-46x2-2p65"
],
"details": "There is a possible Denial of Service vulnerability in the Mime type parser of\nAction Dispatch. This vulnerability has been assigned the CVE identifier\nCVE-2021-22902.\n\nVersions Affected: \u003e= 6.0.0\nNot affected: \u003c 6.0.0\nFixed Versions: 6.0.3.7, 6.1.3.2\n\nImpact\n------\nThere is a possible Denial of Service vulnerability in Action Dispatch.\nCarefully crafted Accept headers can cause the mime type parser in Action\nDispatch to do catastrophic backtracking in the regular expression engine.\n\nWorkarounds\n-----------\nThe following monkey patch placed in an initializer can be used to work around\nthe issue:\n\n```ruby\nmodule Mime\n class Type\n MIME_REGEXP = /\\A(?:\\*\\/\\*|#{MIME_NAME}\\/(?:\\*|#{MIME_NAME})(?\u003e\\s*#{MIME_PARAMETER}\\s*)*)\\z/\n end\nend\n```\n",
"id": "GSD-2021-22902",
"modified": "2021-05-05T00:00:00.000Z",
"published": "2021-05-05T00:00:00.000Z",
"references": [
{
"type": "WEB",
"url": "https://groups.google.com/g/rubyonrails-security/c/_5ID_ld9u1c"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": 7.5,
"type": "CVSS_V3"
}
],
"summary": "Possible Denial of Service vulnerability in Action Dispatch"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "support@hackerone.com",
"ID": "CVE-2021-22902",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "https://github.com/rails/rails",
"version": {
"version_data": [
{
"version_value": "Fixed in 6.0.3.7, 6.1.3.2"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible denial of service vulnerability in the Mime type parser of Action Dispatch. Carefully crafted Accept headers can cause the mime type parser in Action Dispatch to do catastrophic backtracking in the regular expression engine."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Denial of Service (CWE-400)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://hackerone.com/reports/1138654",
"refsource": "MISC",
"url": "https://hackerone.com/reports/1138654"
},
{
"name": "https://discuss.rubyonrails.org/t/cve-2021-22902-possible-denial-of-service-vulnerability-in-action-dispatch/77866",
"refsource": "MISC",
"url": "https://discuss.rubyonrails.org/t/cve-2021-22902-possible-denial-of-service-vulnerability-in-action-dispatch/77866"
}
]
}
},
"github.com/rubysec/ruby-advisory-db": {
"cve": "2021-22902",
"cvss_v3": 7.5,
"date": "2021-05-05",
"description": "There is a possible Denial of Service vulnerability in the Mime type parser of\nAction Dispatch. This vulnerability has been assigned the CVE identifier\nCVE-2021-22902.\n\nVersions Affected: \u003e= 6.0.0\nNot affected: \u003c 6.0.0\nFixed Versions: 6.0.3.7, 6.1.3.2\n\nImpact\n------\nThere is a possible Denial of Service vulnerability in Action Dispatch.\nCarefully crafted Accept headers can cause the mime type parser in Action\nDispatch to do catastrophic backtracking in the regular expression engine.\n\nWorkarounds\n-----------\nThe following monkey patch placed in an initializer can be used to work around\nthe issue:\n\n```ruby\nmodule Mime\n class Type\n MIME_REGEXP = /\\A(?:\\*\\/\\*|#{MIME_NAME}\\/(?:\\*|#{MIME_NAME})(?\u003e\\s*#{MIME_PARAMETER}\\s*)*)\\z/\n end\nend\n```\n",
"framework": "rails",
"gem": "actionpack",
"ghsa": "g8ww-46x2-2p65",
"patched_versions": [
"~\u003e 6.0.3, \u003e= 6.0.3.7",
"\u003e= 6.1.3.2"
],
"title": "Possible Denial of Service vulnerability in Action Dispatch",
"unaffected_versions": [
"\u003c 6.0.0"
],
"url": "https://groups.google.com/g/rubyonrails-security/c/_5ID_ld9u1c"
},
"gitlab.com": {
"advisories": [
{
"affected_range": "\u003e=6.0.0 \u003c6.0.3.7||\u003e=6.1.0 \u003c6.1.0.2",
"affected_versions": "All versions starting from 6.0.0 before 6.0.3.7, all versions starting from 6.1.0 before 6.1.0.2",
"cvss_v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-937"
],
"date": "2021-08-18",
"description": "The actionpack ruby gem (a framework for handling and responding to web requests in Rails) suffers from a possible denial of service vulnerability in the Mime type parser of Action Dispatch. Carefully crafted Accept headers can cause the mime type parser in Action Dispatch to do catastrophic backtracking in the regular expression engine.",
"fixed_versions": [
"6.0.3.7",
"6.1.1"
],
"identifier": "CVE-2021-22902",
"identifiers": [
"CVE-2021-22902"
],
"not_impacted": "All versions before 6.0.0, all versions starting from 6.0.3.7 before 6.1.0, all versions starting from 6.1.0.2",
"package_slug": "gem/actionpack",
"pubdate": "2021-06-11",
"solution": "Upgrade to versions 6.0.3.7, 6.1.1 or above.",
"title": "Uncontrolled Resource Consumption",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2021-22902",
"https://hackerone.com/reports/1138654"
],
"uuid": "7917dd09-4b5c-4d9a-a3fd-f229f9e2c8f9"
},
{
"affected_range": "\u003e=6.0.0 \u003c6.0.3.7||\u003e=6.1.0 \u003c6.1.0.2",
"affected_versions": "All versions starting from 6.0.0 before 6.0.3.7, all versions starting from 6.1.0 before 6.1.0.2",
"cvss_v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-937"
],
"date": "2021-08-18",
"description": "There is a possible Denial of Service vulnerability in Action Dispatch. Carefully crafted `Accept` headers can cause the mime type parser in Action Dispatch to do catastrophic backtracking in the regular expression engine.",
"fixed_versions": [
"6.0.3.7",
"6.1.1"
],
"identifier": "CVE-2021-22902",
"identifiers": [
"CVE-2021-22902"
],
"not_impacted": "All versions before 6.0.0, all versions starting from 6.0.3.7 before 6.1.0, all versions starting from 6.1.0.2",
"package_slug": "gem/rails",
"pubdate": "2021-06-11",
"solution": "Upgrade to versions 6.0.3.7, 6.1.1 or above.",
"title": "Uncontrolled Resource Consumption",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2021-22902",
"https://groups.google.com/g/rubyonrails-security/c/_5ID_ld9u1c"
],
"uuid": "0b7248b9-49bf-4f7e-9b9b-adb8ca18f2d1"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "6.0.3.7",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "6.1.0.2",
"versionStartIncluding": "6.1.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve-assignments@hackerone.com",
"ID": "CVE-2021-22902"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible denial of service vulnerability in the Mime type parser of Action Dispatch. Carefully crafted Accept headers can cause the mime type parser in Action Dispatch to do catastrophic backtracking in the regular expression engine."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://discuss.rubyonrails.org/t/cve-2021-22902-possible-denial-of-service-vulnerability-in-action-dispatch/77866",
"refsource": "MISC",
"tags": [
"Exploit",
"Mitigation",
"Patch",
"Vendor Advisory"
],
"url": "https://discuss.rubyonrails.org/t/cve-2021-22902-possible-denial-of-service-vulnerability-in-action-dispatch/77866"
},
{
"name": "https://hackerone.com/reports/1138654",
"refsource": "MISC",
"tags": [
"Permissions Required",
"Third Party Advisory"
],
"url": "https://hackerone.com/reports/1138654"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
},
"lastModifiedDate": "2021-08-18T19:13Z",
"publishedDate": "2021-06-11T16:15Z"
}
}
}
Loading...