CVE-2022-44566 Denial of Service Vulnerability in ActiveRecord's PostgreSQL adapter
Attackers can cause denial of service in Rails applications by providing out-of-range integers to PostgreSQL adapters, triggering slow sequential scans.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-44566?
CVE-2022-44566 is a high-severity denial of service vulnerability in https://github.com/rails/rails, published on 9 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1. When a value outside the range for a 64bit signed integer is provided to the PostgreSQL connection adapter, it will treat the target column type as numeric. Comparing integer values against numeric values can result in a slow sequential scan resulting in potential Denial of Service.
Weakness: CWE-400
Which versions are affected by CVE-2022-44566?
4 open source packages ship an affected version, including activerecord. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
activerecord RubyGems | All versions | 6.1.7.1 |
activerecord RubyGems | All versions | 6.1.7.1 |
activerecord RubyGems | From 7.0.0 | 7.0.4.1 |
activerecord RubyGems | From 7.0.0 | 7.0.4.1 |
Linux distribution packages (9)
rubygem-activerecord-5_1 SUSE:Linux Enterprise High Availability Extension 15 SP1 | All versions | 5.1.4-150000.5.6.1 |
rubygem-activerecord-5_1 SUSE:Linux Enterprise High Availability Extension 15 SP2 | All versions | 5.1.4-150000.5.6.1 |
rubygem-activerecord-5_1 SUSE:Linux Enterprise High Availability Extension 15 SP3 | All versions | 5.1.4-150000.5.6.1 |
rubygem-activerecord-5_1 SUSE:Linux Enterprise High Availability Extension 15 SP4 | All versions | 5.1.4-150000.5.6.1 |
rubygem-activerecord-4_2 SUSE:OpenStack Cloud Crowbar 8 | All versions | 4.2.9-6.12.1 |
rubygem-activerecord-4_2 SUSE:OpenStack Cloud Crowbar 8 | All versions | 4.2.9-6.9.1 |
rubygem-activerecord-4_2 SUSE:OpenStack Cloud Crowbar 9 | All versions | 4.2.9-6.12.1 |
rubygem-activerecord-4_2 SUSE:OpenStack Cloud Crowbar 9 | All versions | 4.2.9-6.9.1 |
rubygem-activerecord-5_1 openSUSE:Leap 15.4 | All versions | 5.1.4-150000.5.6.1 |
Products include Activerecord Project Activerecord.
How do I fix CVE-2022-44566?
Upgrade activerecord to a fixed version for your release line: 6.1.7.1 or 7.0.4.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-44566 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-44566 exists.
Other vulnerabilities in https://github.com/rails/rails
Sources
Also known as DEBIAN-CVE-2022-44566, GHSA-579w-22j4-4749, SUSE-SU-2023:0492-1, SUSE-SU-2023:0518-1, SUSE-SU-2023:0587-1, UBUNTU-CVE-2022-44566.