MEDIUM

GHSA-73rf-6mrf-759q

devise Time-of-check Time-of-use Race Condition vulnerability

Quick fix

GHSA-73rf-6mrf-759q — devise: upgrade to the fixed version with the command below.

bundle update devise

Details

Devise ruby gem before 4.6.0 when the `lockable` module is used is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to `increment_failed_attempts` within the `Devise::Models::Lockable` class not being concurrency safe.

Are you affected?

Enter the version of the package you're using.

Affected packages

RubyGems/devise

Introduced in: 0Fixed in: 4.6.0

Fixbundle update devise

References

https://nvd.nist.gov/vuln/detail/CVE-2019-5421[ADVISORY]
https://github.com/plataformatec/devise/issues/4981[WEB]
https://github.com/plataformatec/devise/pull/4996[WEB]
https://github.com/plataformatec/devise[PACKAGE]