Debian: CVE-2022-44566: rails -- security update

Debian: CVE-2022-44566: rails -- security update

Severity

8

CVSS

(AV:N/AC:L/Au:N/C:N/I:N/A:C)

Published

02/09/2023

Created

07/31/2024

Added

07/30/2024

Modified

01/30/2025

Description

A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1. When a value outside the range for a 64bit signed integer is provided to the PostgreSQL connection adapter, it will treat the target column type as numeric. Comparing integer values against numeric values can result in a slow sequential scan resulting in potential Denial of Service.

Solution(s)

• debian-upgrade-rails

References

• https://attackerkb.com/topics/cve-2022-44566
• CVE - 2022-44566