devise Time-of-check Time-of-use Race Condition vulnerability · CVE-2019-5421 · GitHub Advisory Database · GitHub

devise Time-of-check Time-of-use Race Condition vulnerability

Moderate severity GitHub Reviewed Published Mar 19, 2019 to the GitHub Advisory Database • Updated Jan 23, 2023

Package

devise (RubyGems)

Affected versions

< 4.6.0

Patched versions

4.6.0

Description

Devise ruby gem before 4.6.0 when the lockable module is used is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to increment_failed_attempts within the Devise::Models::Lockable class not being concurrency safe.

References

Published to the GitHub Advisory Database Mar 19, 2019

Reviewed Jun 16, 2020

Last updated Jan 23, 2023