Lucene search
Debian Security Bug TrackerDEBIANCVE:CVE-2019-25025HistoryMar 05, 2021 - 6:15 a.m.
CVE-2019-25025
2021-03-0506:15:00
Debian Security Bug Tracker
security-tracker.debian.org
7
0.002 Low
EPSS
Percentile
65.0%
The activerecord-session_store (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a correct guess in a relatively short amount of time. This is a related issue to CVE-2019-16782.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Debian | 9 | all | ruby-activerecord-session-store | <= 1.0.0-2 | ruby-activerecord-session-store_1.0.0-2_all.deb |
Related
osv
osv
Activerecord-session_store Vulnerable to Timing Attack
2021-03-09 00:45:31
CVE-2019-25025
2021-03-05 06:15:12
CVE-2019-16782
2019-12-18 20:15:16
prion
prion
Design/Logic Flaw
2021-03-05 06:15:00
Session fixation
2019-12-18 20:15:00
cvelist
cvelist
CVE-2019-25025
2021-03-05 05:54:10
ubuntucve
ubuntucve
CVE-2019-25025
2021-03-05 00:00:00
CVE-2019-16782
2019-12-18 00:00:00
nvd
nvd
CVE-2019-25025
2021-03-05 06:15:12
CVE-2019-16782
2019-12-18 20:15:16
veracode
veracode
Information Disclosure
2021-03-08 02:45:43
Information Disclosure
2019-12-19 05:35:11
gitlab
gitlab
Observable Timing Discrepancy
2021-03-05 00:00:00
github
github
Activerecord-session_store Vulnerable to Timing Attack
2021-03-09 00:45:31
Possible Information Leak / Session Hijack Vulnerability in Rack
2019-12-18 19:01:31
cve
cve
CVE-2019-25025
2021-03-05 06:15:12
CVE-2019-16782
2019-12-18 20:15:16
redhatcve
redhatcve
CVE-2019-25025
2021-03-05 13:33:55
CVE-2019-16782
2020-04-08 21:49:55
ibm
ibm
nessus
nessus
FreeBSD : rack -- information leak / session hijack vulnerability (66e4dc99-28b3-11ea-8dde-08002728f74c)
2019-12-30 00:00:00
Fedora 31 : 1:rubygem-rack (2020-57fc0d0156)
2020-01-21 00:00:00
RHEL 8 : CloudForms 5.0.6 (RHSA-2020:2480)
2020-06-10 00:00:00
openvas
openvas
Fedora: Security Advisory for rubygem-rack (FEDORA-2020-57fc0d0156)
2020-01-27 00:00:00
Mageia: Security Advisory (MGASA-2020-0252)
2022-01-28 00:00:00
openSUSE: Security Advisory for rubygem-rack (openSUSE-SU-2020:0214-1)
2020-02-13 00:00:00
symantec
symantec
Rack CVE-2019-16782 Information Disclosure Vulnerability
2019-12-18 00:00:00
redhat
redhat
(RHSA-2020:2480) Moderate: CloudForms 5.0.6 security, bug fix and enhancement update
2020-06-10 13:30:30
(RHSA-2021:1313) Moderate: Satellite 6.9 Release
2021-04-21 12:43:38
(RHSA-2021:4702) Moderate: Satellite 6.10 Release
2021-11-16 13:58:57
debiancve
debiancve
CVE-2019-16782
2019-12-18 20:15:16
freebsd
freebsd
rack -- information leak / session hijack vulnerability
2019-12-08 00:00:00
fedora
fedora
[SECURITY] Fedora 31 Update: rubygem-rack-2.0.8-1.fc31
2020-01-18 20:55:46
rubygems
rubygems
activerecord-session_store Timing Attack
2021-03-07 21:00:00
mageia
mageia
Updated ruby-rack packages fix security vulnerability
2020-06-11 01:57:01
suse
suse
Security update for rubygem-rack (moderate)
2020-02-12 00:00:00
ubuntu
ubuntu
Rack vulnerabilities
2022-12-13 00:00:00