Activerecord-session_store Vulnerable to Timing Attack

中 5.3CVE-2019-25025 · GHSA-cvw2-xj8r-mjf7 · 05/03/2021 公開 · 17/06/2026 更新

要点

CVE-2019-25025 は activerecord-session_store, active record session store (rubyonrails) に影響する深刻度「中」 (CVSS 5.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.8%（全脆弱性の 78.9% より高い）。
対処：2.0.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
activerecord-session_store RubyGems	`< 2.0.0`	`2.0.0`
active record session store rubyonrails	`≤ 1.1.3`	修正版なし

概要

The activerecord-session_store (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a correct guess in a relatively short amount of time. This is a related issue to CVE-2019-16782.

Recommendation

This has been fixed in version 2.0.0. All users are advised to update to this version or later.

NVD の説明

The activerecord-session_store (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a correct guess in a relatively short amount of time. This is a related issue to CVE-2019-16782.