Home > Vulnerability Database > CVE-2022-44566

Mend.io Vulnerability Database

CVE-2022-44566

Good to know:

Date: February 8, 2023

A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1. When a value outside the range for a 64bit signed integer is provided to the PostgreSQL connection adapter, it will treat the target column type as numeric. Comparing integer values against numeric values can result in a slow sequential scan resulting in potential Denial of Service.

Language: Ruby

Severity Score

7.5

Related Resources (13)

Url: https://github.com/rails/rails

Url: https://makandracards.com/railslts/508019-rails-5-2-lts-changelog#section-jan-20th-2023-rails-version-5-2-8-15

Url: https://rubyonrails.org/2023/1/17/Rails-Versions-6-0-6-1-6-1-7-1-7-0-4-1-have-been-released

Url: https://github.com/rails/rails/commit/4f44aa9d514e701ada92b5cf08beccf566eeaebf

Url: https://github.com/rails/rails/releases/tag/v7.0.4.1

Url: https://discuss.rubyonrails.org/t/cve-2022-44566-possible-denial-of-service-vulnerability-in-activerecords-postgresql-adapter/82119

Url: https://code.jeremyevans.net/2022-11-01-forcing-sequential-scans-on-postgresql.html

Url: https://security-tracker.debian.org/tracker/CVE-2022-44566

Url: https://github.com/rails/rails/commit/82bcdc011e2ff674e7dd8fd8cee3a831c908d29b

Url: https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2022-44566.yml

Url: https://github.com/rails/rails/releases/tag/v6.1.7.1

Url: https://nvd.nist.gov/vuln/detail/CVE-2022-44566

Url: https://www.mend.io/vulnerability-database/CVE-2022-44566

Severity Score

7.5

Weakness Type (CWE)

Uncontrolled Resource Consumption

CWE-400

Top Fix

Upgrade Version

Upgrade to version activerecord - 6.1.7.1;activerecord - 7.0.4.1

Learn More

CVSS v3.1

Base Score:	7.5
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	HIGH

Mend.io Vulnerability Database

We found results for “”

CVE-2022-44566

Good to know:

Date: February 8, 2023

Language: Ruby

Severity Score

Related Resources (13)

Severity Score

Weakness Type (CWE)

Top Fix

Upgrade Version

CVSS v3.1

Do you need more information?