Log in Start free

Vulnerability · Published Dec 18, 2022 · Assigned by VulDB

CVE-2021-4250cgriego active_attr Regex boolean_typecaster.rb call denial of service

Low 3.5

In plain English

A low-severity security flaw in active_attr from cgriego. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)1.2%top 32.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A vulnerability classified as problematic has been found in cgriego active_attr up to 0.15.2. This affects the function call of the file lib/active_attr/typecasting/boolean_typecaster.rb of the component Regex Handler. The manipulation of the argument value leads to denial of service. The exploit has been disclosed to the public and may be used. Upgrading to version 0.15.3 is able to address this issue. The name of the patch is dab95e5843b01525444b82bd7b336ef1d79377df. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216207.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
RubyGemsactive_attr0.15.4GHSA-4whf-rmx5-8frv

Affected products (as reported)

VendorProductVersions
cgriego active_attr 0.15.00.15.10.15.2

Weakness: CWE-404 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References