{"id":"CVE-2021-22904","published":"2021-06-11T15:49:38Z","modified":"2024-08-03T18:58:25Z","title":"The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service…","vendor":null,"product":null,"tier":"tail","description":{"text":"The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression. Impacted code uses `authenticate_or_request_with_http_token` or `authenticate_with_http_token` for request authentication.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.04868,"percentile":0.92014,"provenance":"source"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"references":[{"url":"https://hackerone.com/reports/1101125","tags":["x_refsource_MISC"]},{"url":"https://discuss.rubyonrails.org/t/cve-2021-22904-possible-dos-vulnerability-in-action-controller-token-authentication/77869","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20210805-0009/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":18.4,"factors":[{"name":"EPSS percentile","points":18.4}]},"affectedVersions":[{"vendor":"n/a","product":"https://github.com/rails/rails","versions":["Fixed in 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6"]}],"affected":[{"ecosystem":"RubyGems","package":"actionpack","vulnerableRanges":[">=6.0.0, <6.0.3.7",">=6.1.0, <6.1.3.2",">=5.2.5, <5.2.6",">=4.0.0, <5.2.4.6"],"patched":["6.0.3.7","6.1.3.2","5.2.6","5.2.4.6"],"from":["GHSA-7wjx-3g7j-8584"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-1009","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2020-8166","published":"2020-07-02","fixed":"6.0.3.1","kev":false,"link":{"from":"CVE-2020-8166","to":"CVE-2021-22904","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:actionpack","fromFixed":"5.2.4.3","toFixed":"5.2.4.6","daysApart":344}]}},{"cve":"CVE-2021-22881","published":"2021-02-11","fixed":"6.1.2.1","kev":false,"link":{"from":"CVE-2021-22881","to":"CVE-2021-22904","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:actionpack","fromFixed":"6.0.3.5","toFixed":"6.0.3.7","daysApart":120}]}},{"cve":"CVE-2021-22885","published":"2021-05-27","fixed":"6.1.3.2","kev":false},{"cve":"CVE-2021-22902","published":"2021-06-11","fixed":"6.1.3.2","kev":false},{"cve":"CVE-2021-22903","published":"2021-06-11","fixed":"6.1.3.2","kev":false},{"cve":"CVE-2021-22904","published":"2021-06-11","fixed":"6.1.3.2","kev":false},{"cve":"CVE-2021-22942","published":"2021-10-18","fixed":"6.1.4.1","kev":false,"link":{"from":"CVE-2021-22904","to":"CVE-2021-22942","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:actionpack","fromFixed":"6.0.3.7","toFixed":"6.0.4.1","daysApart":129}]}},{"cve":"CVE-2021-44528","published":"2022-01-07","fixed":"6.1.4.2","kev":false},{"cve":"CVE-2022-23633","published":"2022-02-11","fixed":"7.0.2.2","kev":false,"link":{"from":"CVE-2021-22904","to":"CVE-2022-23633","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:actionpack","fromFixed":"5.2.6","toFixed":"5.2.6.2","daysApart":245}]}}],"package":"RubyGems:actionpack"}}