CVE-2021-22904
Description
The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression. Impacted code uses `authenticate_or_request_with_http_token` or `authenticate_with_http_token` for request authentication.
CWE
- CWE-400 — Denial of Service (CWE-400)
Affected
- n/a / https://github.com/rails/rails — v=Fixed in 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 [affected]
CVSS
- (none)
References
- https://hackerone.com/reports/1101125 x_refsource_MISC
- https://discuss.rubyonrails.org/t/cve-2021-22904-possible-dos-vulnerability-in-action-controller-token-authentication/77869 x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20210805-0009/ x_refsource_CONFIRM
Source
cvelistV5-main/cves/2021/22xxx/CVE-2021-22904.json