USN-7050-1: Devise-Two-Factor vulnerabilities
Benoit Côté-Jodoin and Michael Nipper discovered that Devise-Two-Factor incorrectly handled one-time password validation. An attacker could possibly use this issue to intercept and re-use a one-time password. (CVE-2021-43177) Garrett Rappaport discovered that Devise-Two-Factor incorrectly handled generating multi-factor authentication codes. An attacker could possibly use this issue to generate valid multi-factor authentication codes. (CVE-2024-8796)
Affected Software
Event History
Frequently Asked Questions
What is the severity of USN-7050-1?
The severity of USN-7050-1 is significant due to its potential for an attacker to intercept and reuse one-time passwords.
How do I fix USN-7050-1?
To fix USN-7050-1, update the ruby-devise-two-factor package to version 4.0.0-2ubuntu0.1~esm1 for Ubuntu 22.04 or to version 3.1.0-2ubuntu0.1~esm1 for Ubuntu 20.04.
What vulnerabilities are addressed in USN-7050-1?
USN-7050-1 addresses vulnerabilities related to inadequate handling of one-time password validation in the Devise-Two-Factor package.
Is my system affected by USN-7050-1?
If you are using ruby-devise-two-factor version 4.0.0-2ubuntu0.1~esm1 or 3.1.0-2ubuntu0.1~esm1 on Ubuntu 22.04 or 20.04, respectively, your system is affected by USN-7050-1.
How can attackers exploit the vulnerability in USN-7050-1?
Attackers can exploit USN-7050-1 by intercepting one-time passwords and reusing them for unauthorized access.