GHSA-73rf-6mrf-759q

devise Time-of-check Time-of-use Race Condition vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-5421

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	devise	< 4.6.0	4.6.0

Details

As written in the advisory (Markdown source, shown as plain text).

Devise ruby gem before 4.6.0 when the `lockable` module is used is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to `increment_failed_attempts` within the `Devise::Models::Lockable` class not being concurrency safe.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-5421 advisory
https://github.com/plataformatec/devise/issues/4981 web
https://github.com/plataformatec/devise/pull/4996 web
https://github.com/plataformatec/devise package