Candidate: CVE-2021-22904
PublicDate: 2021-06-11 16:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22904
 https://github.com/rails/rails/commit/eab8c20f3ef6a022c4c11b439b1b22cef1768d5e (main)
 https://github.com/rails/rails/commit/d861fa8ade353390c4419b53a6c6b41f3005b1f2 (v6.0.3.7)
 https://github.com/rails/rails/commit/3d9e9fdf14e044b3ba66f909582c228a9d4ffb5c (v5.2.4.6)
Description:
 The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers
 from a possible denial of service vulnerability in the Token Authentication
 logic in Action Controller due to a too permissive regular expression.
 Impacted code uses `authenticate_or_request_with_http_token` or
 `authenticate_with_http_token` for request authentication.
Ubuntu-Description:
Notes:
 seth-arnold> In Oneiric-Saucy, rails package is just for transition;
 seth-arnold> The rails package contains actual code from vivid onward
Mitigation:
Bugs:
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H [7.5 HIGH]

Patches_rails:
upstream_rails: needs-triage
precise/esm_rails: DNE
trusty_rails: ignored (out of standard support)
trusty/esm_rails: DNE
xenial_rails: ignored (end of standard support, was needs-triage)
bionic_rails: needs-triage
focal_rails: needs-triage
groovy_rails: ignored (reached end-of-life)
hirsute_rails: ignored (reached end-of-life)
impish_rails: needs-triage
jammy_rails: needs-triage
devel_rails: needs-triage

Patches_ruby-rails-3.2:
upstream_ruby-rails-3.2: needs-triage
precise/esm_ruby-rails-3.2: DNE
trusty_ruby-rails-3.2: ignored (out of standard support)
trusty/esm_ruby-rails-3.2: DNE
xenial_ruby-rails-3.2: DNE
bionic_ruby-rails-3.2: DNE
focal_ruby-rails-3.2: DNE
groovy_ruby-rails-3.2: DNE
hirsute_ruby-rails-3.2: DNE
impish_ruby-rails-3.2: DNE
jammy_ruby-rails-3.2: DNE
devel_ruby-rails-3.2: DNE

Patches_ruby-actionpack-3.2:
upstream_ruby-actionpack-3.2: needs-triage
precise/esm_ruby-actionpack-3.2: DNE
trusty_ruby-actionpack-3.2: ignored (out of standard support)
trusty/esm_ruby-actionpack-3.2: DNE
xenial_ruby-actionpack-3.2: DNE
bionic_ruby-actionpack-3.2: DNE
focal_ruby-actionpack-3.2: DNE
groovy_ruby-actionpack-3.2: DNE
hirsute_ruby-actionpack-3.2: DNE
impish_ruby-actionpack-3.2: DNE
jammy_ruby-actionpack-3.2: DNE
devel_ruby-actionpack-3.2: DNE

Patches_ruby-activesupport-3.2:
upstream_ruby-activesupport-3.2: needs-triage
precise/esm_ruby-activesupport-3.2: DNE
trusty_ruby-activesupport-3.2: ignored (out of standard support)
trusty/esm_ruby-activesupport-3.2: DNE
xenial_ruby-activesupport-3.2: DNE
bionic_ruby-activesupport-3.2: DNE
focal_ruby-activesupport-3.2: DNE
groovy_ruby-activesupport-3.2: DNE
hirsute_ruby-activesupport-3.2: DNE
impish_ruby-activesupport-3.2: DNE
jammy_ruby-activesupport-3.2: DNE
devel_ruby-activesupport-3.2: DNE

Patches_ruby-activerecord-3.2:
upstream_ruby-activerecord-3.2: needs-triage
precise/esm_ruby-activerecord-3.2: DNE
trusty_ruby-activerecord-3.2: ignored (out of standard support)
trusty/esm_ruby-activerecord-3.2: DNE
xenial_ruby-activerecord-3.2: DNE
bionic_ruby-activerecord-3.2: DNE
focal_ruby-activerecord-3.2: DNE
groovy_ruby-activerecord-3.2: DNE
hirsute_ruby-activerecord-3.2: DNE
impish_ruby-activerecord-3.2: DNE
jammy_ruby-activerecord-3.2: DNE
devel_ruby-activerecord-3.2: DNE

Patches_ruby-activemodel-3.2:
upstream_ruby-activemodel-3.2: needs-triage
precise/esm_ruby-activemodel-3.2: DNE
trusty_ruby-activemodel-3.2: ignored (out of standard support)
trusty/esm_ruby-activemodel-3.2: DNE
xenial_ruby-activemodel-3.2: DNE
bionic_ruby-activemodel-3.2: DNE
focal_ruby-activemodel-3.2: DNE
groovy_ruby-activemodel-3.2: DNE
hirsute_ruby-activemodel-3.2: DNE
impish_ruby-activemodel-3.2: DNE
jammy_ruby-activemodel-3.2: DNE
devel_ruby-activemodel-3.2: DNE

Patches_rails-4.0:
upstream_rails-4.0: needs-triage
precise/esm_rails-4.0: DNE
trusty_rails-4.0: ignored (out of standard support)
trusty/esm_rails-4.0: DNE
xenial_rails-4.0: DNE
bionic_rails-4.0: DNE
focal_rails-4.0: DNE
groovy_rails-4.0: DNE
hirsute_rails-4.0: DNE
impish_rails-4.0: DNE
jammy_rails-4.0: DNE
devel_rails-4.0: DNE