CVE-2021-43805: Inefficient Regular Expression Complexity

December 7, 2021 (updated December 8, 2021)

Solidus is a free, open-source ecommerce platform built on Rails.If a prompt upgrade is not an option, a workaround is available. It is possible to edit the file config/application.rb manually (with code provided by the maintainers in the GitHub Security Advisory) to check email validity.

References

github.com/solidusio/solidus/commit/9867153e01e3c3b898cdbcedd7b43375ea922401
github.com/solidusio/solidus/security/advisories/GHSA-qxmr-qxh6-2cc9
nvd.nist.gov/vuln/detail/CVE-2021-43805

Detect and mitigate CVE-2021-43805 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →