CVE-2019-25025: Medium severity rubyonrails Active Record Session Store Ruby On Rails vulnerability
The activerecord-sessionstore (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a correct guess in a relatively short amount of time. This is a related issue to CVE-2019-16782.
Recommendation
This has been fixed in version 2.0.0. All users are advised to update to this version or later.
Other sources
The activerecord-sessionstore (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a correct guess in a relatively short amount of time. This is a related issue to CVE-2019-16782.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/activerecord-session_storeto a version that resolves this vulnerability.Fixed in 2.0.0
Event History
Frequently Asked Questions
What is CVE-2019-25025?
CVE-2019-25025 is a vulnerability in the activerecord-session_store component for Ruby on Rails that allows remote attackers to exploit timing discrepancies to determine the validity of guessed session IDs.
How severe is CVE-2019-25025?
CVE-2019-25025 has a severity rating of 5.3 (Medium).
What software is affected by CVE-2019-25025?
The activerecord-session_store component through version 1.1.3 for Ruby on Rails is affected.
How can I fix CVE-2019-25025?
To fix CVE-2019-25025, upgrade the activerecord-session_store component to version 2.0.0 or newer.
Where can I find more information about CVE-2019-25025?
More information about CVE-2019-25025 can be found at the following references: [link1], [link2], [link3].