CVE-2019-25025

2021-03-0506:15:12

Google

osv.dev

6.5 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

65.0%

JSON

The activerecord-session_store (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a correct guess in a relatively short amount of time. This is a related issue to CVE-2019-16782.

CPENameOperatorVersion
activerecord-session_storeeq1.1.0
activerecord-session_storeeq0.1.2
activerecord-session_storeeq1.1.1
activerecord-session_storeeq0.1.1
activerecord-session_storeeq1.0.0.pre
activerecord-session_storeeq0.0.1
activerecord-session_storeeq1.1.2
activerecord-session_storeeq1.1.3
activerecord-session_storeeq0.1.0
activerecord-session_storeeq1.0.0

Name	Operator	Version
activerecord-session_store	eq	1.1.0
activerecord-session_store	eq	0.1.2
activerecord-session_store	eq	1.1.1
activerecord-session_store	eq	0.1.1
activerecord-session_store	eq	1.0.0.pre
activerecord-session_store	eq	0.0.1
activerecord-session_store	eq	1.1.2
activerecord-session_store	eq	1.1.3
activerecord-session_store	eq	0.1.0
activerecord-session_store	eq	1.0.0