Skip to content

Add CVE-2019-25025 for activerecord-session_store #462

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

Add CVE-2019-25025 for activerecord-session_store #462

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions gems/activerecord-session_store/CVE-2019-25025.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
---
gem: activerecord-session_store
cve: 2019-25025
date: 2019-12-22
url: https://github.com/rails/activerecord-session_store/pull/151
title: |
Activerecord-session_store Timing Attack

description: |
The activerecord-session_store (aka Active Record Session Store) component
through 1.1.3 for Ruby on Rails does not use a constant-time approach when
delivering information about whether a guessed session ID is valid.
Consequently, remote attackers can leverage timing discrepancies to achieve a
correct guess in a relatively short amount of time. This is a related issue to
CVE-2019-16782.

related:
cve:
- 2019-16782