deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-gr44-7grc-37vq
Package: activerecord (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-284: Improper Access Control
Vulnerable versions: < 2.3.17
Patched in: 2.3.17

Summary: ActiveRecord vulnerable to modification of protected model attributes

Details:
ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the `attr_protected` protection mechanism and modify protected model attributes via a crafted request.
GitHub Security Advisory: GHSA-q759-hwvc-m3jg
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 3.2.0, < 3.2.13
Patched in: 3.2.13

Summary: actionpack Cross-site Scripting vulnerability

Details:
The `sanitize_css` method in `lib/action_controller/vendor/html-scanner/html/sanitizer.rb` in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle `\n` (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences.
GitHub Security Advisory: GHSA-q759-hwvc-m3jg
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 3.0.0, < 3.1.12
Patched in: 3.1.12

Summary: actionpack Cross-site Scripting vulnerability

Details:
The `sanitize_css` method in `lib/action_controller/vendor/html-scanner/html/sanitizer.rb` in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle `\n` (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences.
GitHub Security Advisory: GHSA-q759-hwvc-m3jg
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.3.18
Patched in: 2.3.18

Summary: actionpack Cross-site Scripting vulnerability

Details:
The `sanitize_css` method in `lib/action_controller/vendor/html-scanner/html/sanitizer.rb` in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle `\n` (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences.
GitHub Security Advisory: GHSA-h56m-vwxc-3qpw
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 4.2.0.beta1, < 4.2.0.beta4
Patched in: 4.2.0.beta4

Summary: Directory traversal vulnerability in actionpack

Details:
Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.
GitHub Security Advisory: GHSA-h56m-vwxc-3qpw
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 4.1.0, < 4.1.8
Patched in: 4.1.8

Summary: Directory traversal vulnerability in actionpack

Details:
Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.
GitHub Security Advisory: GHSA-h56m-vwxc-3qpw
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 4.0.0, < 4.0.12
Patched in: 4.0.12

Summary: Directory traversal vulnerability in actionpack

Details:
Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.
GitHub Security Advisory: GHSA-h56m-vwxc-3qpw
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 3.0.0, < 3.2.21
Patched in: 3.2.21

Summary: Directory traversal vulnerability in actionpack

Details:
Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.
GitHub Security Advisory: GHSA-29gr-w57f-rpfw
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 4.2.0.beta1, < 4.2.0.beta3
Patched in: 4.2.0.beta3

Summary: actionpack vulnerable to Path Traversal

Details:
Directory traversal vulnerability in `actionpack/lib/action_dispatch/middleware/static.rb` in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when `serve_static_assets` is enabled, allows remote attackers to determine the existence of files outside the application root via a `/..%2F` sequence.
GitHub Security Advisory: GHSA-29gr-w57f-rpfw
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 4.1.0, < 4.1.7
Patched in: 4.1.7

Summary: actionpack vulnerable to Path Traversal

Details:
Directory traversal vulnerability in `actionpack/lib/action_dispatch/middleware/static.rb` in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when `serve_static_assets` is enabled, allows remote attackers to determine the existence of files outside the application root via a `/..%2F` sequence.
GitHub Security Advisory: GHSA-29gr-w57f-rpfw
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 4.0.0, < 4.0.11
Patched in: 4.0.11

Summary: actionpack vulnerable to Path Traversal

Details:
Directory traversal vulnerability in `actionpack/lib/action_dispatch/middleware/static.rb` in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when `serve_static_assets` is enabled, allows remote attackers to determine the existence of files outside the application root via a `/..%2F` sequence.
GitHub Security Advisory: GHSA-29gr-w57f-rpfw
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 3.0.0, < 3.2.20
Patched in: 3.2.20

Summary: actionpack vulnerable to Path Traversal

Details:
Directory traversal vulnerability in `actionpack/lib/action_dispatch/middleware/static.rb` in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when `serve_static_assets` is enabled, allows remote attackers to determine the existence of files outside the application root via a `/..%2F` sequence.
GitHub Security Advisory: GHSA-v3rr-cph9-2g2q
Package: rack-ssl (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.4.0
Patched in: 1.4.0

Summary: rack-ssl Cross-site Scripting vulnerability

Details:
Cross-site scripting (XSS) vulnerability in `lib/rack/ssl.rb` in the rack-ssl gem before 1.4.0 for Ruby allows remote attackers to inject arbitrary web script or HTML via a URI, which might not be properly handled by third-party adapters such as JRuby-Rack.
GitHub Security Advisory: GHSA-wpw7-wxjm-cw8r
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-284: Improper Access Control
Vulnerable versions: >= 4.0.0, < 4.0.2
Patched in: 4.0.2

Summary: actionpack allows bypass of database-query restrictions

Details:
`actionpack/lib/action_dispatch/http/request.rb` in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.
GitHub Security Advisory: GHSA-wpw7-wxjm-cw8r
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-284: Improper Access Control
Vulnerable versions: >= 3.0.0, < 3.2.16
Patched in: 3.2.16

Summary: actionpack allows bypass of database-query restrictions

Details:
`actionpack/lib/action_dispatch/http/request.rb` in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.
GitHub Security Advisory: GHSA-699m-mcjm-9cw8
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.0.0, < 4.0.2
Patched in: 4.0.2

Summary: actionpack vulnerable to Cross-site Scripting

Details:
Cross-site scripting (XSS) vulnerability in `actionpack/lib/action_view/helpers/translation_helper.rb` in the internationalization component in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted string that triggers generation of a fallback string by the i18n gem.
GitHub Security Advisory: GHSA-699m-mcjm-9cw8
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 3.0.0, < 3.2.16
Patched in: 3.2.16

Summary: actionpack vulnerable to Cross-site Scripting

Details:
Cross-site scripting (XSS) vulnerability in `actionpack/lib/action_view/helpers/translation_helper.rb` in the internationalization component in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted string that triggers generation of a fallback string by the i18n gem.
GitHub Security Advisory: GHSA-6h5q-96hp-9jgm
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.0.0, < 4.0.2
Patched in: 4.0.2

Summary: actionpack vulnerable to Cross-site Scripting

Details:
Cross-site scripting (XSS) vulnerability in the `number_to_currency` helper in `actionpack/lib/action_view/helpers/number_helper.rb` in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the unit parameter.
GitHub Security Advisory: GHSA-6h5q-96hp-9jgm
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 3.0.0, < 3.2.16
Patched in: 3.2.16

Summary: actionpack vulnerable to Cross-site Scripting

Details:
Cross-site scripting (XSS) vulnerability in the `number_to_currency` helper in `actionpack/lib/action_view/helpers/number_helper.rb` in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the unit parameter.
GitHub Security Advisory: GHSA-h6rj-8r3c-9gpj
Package: bson (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 1.12.3
Patched in: 1.12.3

Summary: bson is vulnerable to denial of service due to incorrect regex validation

Details:
BSON injection vulnerability in the legal function in BSON (bson-ruby) gem before 3.0.4 for Ruby allows remote attackers to cause a denial of service (resource consumption) or inject arbitrary data via a crafted string.
GitHub Security Advisory: GHSA-h6rj-8r3c-9gpj
Package: bson (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 2.0, < 3.0.4
Patched in: 3.0.4

Summary: bson is vulnerable to denial of service due to incorrect regex validation

Details:
BSON injection vulnerability in the legal function in BSON (bson-ruby) gem before 3.0.4 for Ruby allows remote attackers to cause a denial of service (resource consumption) or inject arbitrary data via a crafted string.
GitHub Security Advisory: GHSA-cr5q-6q9f-rq6q
Package: activesupport (RUBYGEMS)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-377: Insecure Temporary File, CWE-732: Incorrect Permission Assignment for Critical Resource
Vulnerable versions: >= 7.0.0, < 7.0.7.1
Patched in: 7.0.7.1

Summary: Active Support Possibly Discloses Locally Encrypted Files

Details:
There is a possible file disclosure of locally encrypted files in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-38037.

Versions Affected: >= 5.2.0 Not affected: < 5.2.0 Fixed Versions: 7.0.7.1, 6.1.7.5

# Impact
ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file’s permissions are defaulted to the user’s current umask settings, meaning that it’s possible for other users on the same system to read the contents of the temporary file.

Attackers that have access to the file system could possibly read the contents of this temporary file while a user is editing it.

All users running an affected release should either upgrade or use one of the workarounds immediately.

# Releases
The fixed releases are available at the normal locations.

# Workarounds
To work around this issue, you can set your umask to be more restrictive like this:

```ruby
$ umask 0077
```
GitHub Security Advisory: GHSA-cr5q-6q9f-rq6q
Package: activesupport (RUBYGEMS)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-377: Insecure Temporary File, CWE-732: Incorrect Permission Assignment for Critical Resource
Vulnerable versions: >= 5.2.0, < 6.1.7.5
Patched in: 6.1.7.5

Summary: Active Support Possibly Discloses Locally Encrypted Files

Details:
There is a possible file disclosure of locally encrypted files in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-38037.

Versions Affected: >= 5.2.0 Not affected: < 5.2.0 Fixed Versions: 7.0.7.1, 6.1.7.5

# Impact
ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file’s permissions are defaulted to the user’s current umask settings, meaning that it’s possible for other users on the same system to read the contents of the temporary file.

Attackers that have access to the file system could possibly read the contents of this temporary file while a user is editing it.

All users running an affected release should either upgrade or use one of the workarounds immediately.

# Releases
The fixed releases are available at the normal locations.

# Workarounds
To work around this issue, you can set your umask to be more restrictive like this:

```ruby
$ umask 0077
```
GitHub Security Advisory: GHSA-7h48-m3rw-vr27
Package: spree (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 0.4.0
Patched in: 0.4.0

Summary: Spree does not properly restrict the use of a hash to provide values for a model's attributes

Details:
Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a "mass assignment" vulnerability.
GitHub Security Advisory: GHSA-g466-57gh-cqfw
Package: spree (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 0.4.0
Patched in: 0.4.0

Summary: Spree uses a hardcoded hash value

Details:
The session cookie store implementation in Spree 0.2.0 uses a hardcoded `config.action_controller_session` hash value (aka secret key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging an application that contains this value within the `config/environment.rb` file.
GitHub Security Advisory: GHSA-68xg-gqqm-vgj8
Package: puma (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: < 5.6.7
Patched in: 5.6.7

Summary: Puma HTTP Request/Response Smuggling vulnerability

Details:
### Impact
Prior to version 6.3.1, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling.

The following vulnerabilities are addressed by this advisory:

* Incorrect parsing of trailing fields in chunked transfer encoding bodies
* Parsing of blank/zero-length Content-Length headers

### Patches
The vulnerability has been fixed in 6.3.1 and 5.6.7.

### Workarounds
No known workarounds.

### References
[HTTP Request Smuggling](https://portswigger.net/web-security/request-smuggling)

### For more information
If you have any questions or comments about this advisory:

Open an issue in [Puma](https://github.com/puma/puma)
See our [security policy](https://github.com/puma/puma/security/policy)
GitHub Security Advisory: GHSA-68xg-gqqm-vgj8
Package: puma (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: >= 6.0.0, < 6.3.1
Patched in: 6.3.1

Summary: Puma HTTP Request/Response Smuggling vulnerability

Details:
### Impact
Prior to version 6.3.1, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling.

The following vulnerabilities are addressed by this advisory:

* Incorrect parsing of trailing fields in chunked transfer encoding bodies
* Parsing of blank/zero-length Content-Length headers

### Patches
The vulnerability has been fixed in 6.3.1 and 5.6.7.

### Workarounds
No known workarounds.

### References
[HTTP Request Smuggling](https://portswigger.net/web-security/request-smuggling)

### For more information
If you have any questions or comments about this advisory:

Open an issue in [Puma](https://github.com/puma/puma)
See our [security policy](https://github.com/puma/puma/security/policy)
GitHub Security Advisory: GHSA-579w-22j4-4749
Package: activerecord (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 6.1.7.1
Patched in: 6.1.7.1

Summary: Denial of Service Vulnerability in ActiveRecord's PostgreSQL adapter

Details:
There is a potential denial of service vulnerability present in ActiveRecord's PostgreSQL adapter.

This has been assigned the CVE identifier CVE-2022-44566.

Versions Affected: All. Not affected: None.

## Fixed Versions

- 2.3.18.47 (Rails LTS, which is a paid service and not part of the rubygem)
- 3.2.22.34 (Rails LTS, which is a paid service and not part of the rubygem)
- 4.2.11.27 (Rails LTS, which is a paid service and not part of the rubygem)
- 5.2.8.15 (Rails LTS, which is a paid service and not part of the rubygem)
- 6.1.7.1
- 7.0.4.1

## Impact

In ActiveRecord < 7.0.4.1 and < 6.1.7.1, when a value outside the range for a 64bit signed integer is provided to the PostgreSQL connection adapter, it will treat the target column type as numeric. Comparing integer values against numeric values can result in a slow sequential scan resulting in potential Denial of Service.

## Releases

The fixed releases are available at the normal locations.

## Workarounds

Ensure that user supplied input which is provided to ActiveRecord clauses do not contain integers wider than a signed 64bit representation or floats. 

## Patches

To aid users who aren't able to upgrade immediately we have provided patches for the supported release series in accordance with our maintenance policy 1 regarding security issues. They are in git-am format and consist of a single changeset.

 6-1-Added-integer-width-check-to-PostgreSQL-Quoting.patch - Patch for 6.1 series
 7-0-Added-integer-width-check-to-PostgreSQL-Quoting.patch - Patch for 7.0 series
GitHub Security Advisory: GHSA-579w-22j4-4749
Package: activerecord (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 7.0.0, < 7.0.4.1
Patched in: 7.0.4.1

Summary: Denial of Service Vulnerability in ActiveRecord's PostgreSQL adapter

Details:
There is a potential denial of service vulnerability present in ActiveRecord's PostgreSQL adapter.

This has been assigned the CVE identifier CVE-2022-44566.

Versions Affected: All. Not affected: None.

## Fixed Versions

- 2.3.18.47 (Rails LTS, which is a paid service and not part of the rubygem)
- 3.2.22.34 (Rails LTS, which is a paid service and not part of the rubygem)
- 4.2.11.27 (Rails LTS, which is a paid service and not part of the rubygem)
- 5.2.8.15 (Rails LTS, which is a paid service and not part of the rubygem)
- 6.1.7.1
- 7.0.4.1

## Impact

In ActiveRecord < 7.0.4.1 and < 6.1.7.1, when a value outside the range for a 64bit signed integer is provided to the PostgreSQL connection adapter, it will treat the target column type as numeric. Comparing integer values against numeric values can result in a slow sequential scan resulting in potential Denial of Service.

## Releases

The fixed releases are available at the normal locations.

## Workarounds

Ensure that user supplied input which is provided to ActiveRecord clauses do not contain integers wider than a signed 64bit representation or floats. 

## Patches

To aid users who aren't able to upgrade immediately we have provided patches for the supported release series in accordance with our maintenance policy 1 regarding security issues. They are in git-am format and consist of a single changeset.

 6-1-Added-integer-width-check-to-PostgreSQL-Quoting.patch - Patch for 6.1 series
 7-0-Added-integer-width-check-to-PostgreSQL-Quoting.patch - Patch for 7.0 series