| Package | Affected versions | Patched versions |
|---|---|---|
| audited | ≥ 4.0.0, < 5.3.3 | 5.3.3 |
| audited | ≥ 4.0.0, < 5.3.3 | 5.3.3 |
In certain setups with threaded web servers, Audited's use of Thread.current can incorrectly attributed audits to the wrong user.
Fixed in 5.3.3.
In March, @convisoappsec noticed that the library in question had a Race Condition problem, which caused logs to be registered at times with different users than those who performed the genuine actions.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free