GitHub Advisoryadvisory · RubyGems

GHSA-73rf-6mrf-759q devise Time-of-check Time-of-use Race Condition vulnerability

MEDIUM Published 2019-03-19 Modified 2023-01-23 Official page ↗
Aliases
CVE-2019-5421
Ecosystem
RubyGems
Packages
devise
Severity
Moderate
Weaknesses
CWE-367
Reviewed
2020-06-16

Affected packages

• RubyGems devise: < 4.6.0 → fixed in 4.6.0

Description

Devise ruby gem before 4.6.0 when the `lockable` module is used is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to `increment_failed_attempts` within the `Devise::Models::Lockable` class not being concurrency safe.

Related

Alias · CVE (1)

  • CVE-2019-5421 Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in The… vulnerability

Weakness · CWE (1)

  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition weakness

References