Ruby/devise/4.1.1
Flexible authentication solution for Rails with Warden
https://rubygems.org/gems/devise
MIT
4 Security Vulnerabilities
devise Time-of-check Time-of-use Race Condition vulnerability
Devise ruby gem before 4.6.0 when the lockable
module is used is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to increment_failed_attempts
within the Devise::Models::Lockable
class not being concurrency safe.
Authentication Bypass in Devise
- https://nvd.nist.gov/vuln/detail/CVE-2019-16109
- https://github.com/advisories/GHSA-fcjw-8rhj-gwwc
- https://github.com/plataformatec/devise/compare/v4.7.0...v4.7.1
- https://github.com/plataformatec/devise/issues/5071
- https://github.com/plataformatec/devise/pull/5132
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/devise/CVE-2019-16109.yml
An issue was discovered in Plataformatec Devise before 4.7.1. It confirms accounts upon receiving a request with a blank confirmationtoken, if a database record has a blank value in the confirmationtoken column. (However, there is no scenario within Devise itself in which such database records would exist.)
Devise Gem for Ruby confirmation token validation with a blank string
Devise before 4.7.1 confirms accounts upon receiving a request with a blank confirmationtoken, if a database record has a blank value in the confirmationtoken column. However, there is no scenario within Devise itself in which such database records would exist.
Devise Gem for Ruby Time-of-check Time-of-use race condition with lockable module
Devise ruby gem before 4.6.0 when the lockable
module is used is vulnerable to a
time-of-check time-of-use (TOCTOU) race condition due to increment_failed_attempts
within the Devise::Models::Lockable
class not being concurrency safe.
167 Other Versions
Version | License | Security | Released | |
---|---|---|---|---|
2.1.0 | UNKNOWN | 8 | 2012-05-15 - 17:16 | about 12 years |
2.0.1 | UNKNOWN | 8 | 2012-02-09 - 10:15 | over 12 years |
2.1.2 | UNKNOWN | 8 | 2012-06-19 - 09:27 | almost 12 years |
2.0.0 | UNKNOWN | 8 | 2012-01-26 - 19:45 | over 12 years |
1.5.3 | UNKNOWN | 8 | 2011-12-19 - 11:57 | over 12 years |
2.0.2 | UNKNOWN | 8 | 2012-02-15 - 16:26 | over 12 years |
2.0.4 | UNKNOWN | 8 | 2012-02-17 - 08:32 | about 12 years |
1.5.1 | UNKNOWN | 8 | 2011-11-22 - 15:13 | over 12 years |
1.5.0 | UNKNOWN | 8 | 2011-11-13 - 21:23 | over 12 years |
1.5.2 | UNKNOWN | 8 | 2011-11-30 - 09:26 | over 12 years |
2.2.0 | UNKNOWN | 8 | 2013-01-08 - 20:31 | over 11 years |
2.2.1 | UNKNOWN | 8 | 2013-01-11 - 18:16 | over 11 years |
2.2.2 | UNKNOWN | 8 | 2013-01-15 - 20:03 | over 11 years |
4.6.0 | MIT | 2 | 2019-02-07 - 17:41 | over 5 years |
4.6.1 | MIT | 2 | 2019-02-11 - 15:28 | over 5 years |
4.7.0 | MIT | 2 | 2019-08-19 - 16:47 | over 4 years |
4.6.2 | MIT | 2 | 2019-03-26 - 16:55 | about 5 years |
4.1.0 | MIT | 4 | 2016-05-03 - 02:52 | about 8 years |
4.0.2 | MIT | 4 | 2016-05-03 - 02:44 | about 8 years |
4.1.1 | MIT | 4 | 2016-05-15 - 15:04 | about 8 years |
4.0.0 | MIT | 4 | 2016-04-18 - 14:53 | about 8 years |
4.0.0.rc2 | MIT | 4 | 2016-03-09 - 14:31 | about 8 years |
4.0.0.rc1 | MIT | 4 | 2016-02-01 - 11:21 | over 8 years |
4.0.3 | MIT | 4 | 2016-05-15 - 15:08 | about 8 years |
4.0.1 | MIT | 4 | 2016-04-25 - 20:07 | about 8 years |
3.5.10 | MIT | 4 | 2016-05-15 - 15:14 | about 8 years |
4.3.0 | MIT | 4 | 2017-05-15 - 00:12 | about 7 years |
4.4.1 | MIT | 4 | 2018-01-23 - 18:11 | over 6 years |
4.4.2 | MIT | 4 | 2018-03-15 - 13:50 | about 6 years |
4.4.0 | MIT | 4 | 2017-12-29 - 19:50 | over 6 years |
4.2.1 | MIT | 4 | 2017-03-15 - 15:36 | about 7 years |
4.5.0 | MIT | 4 | 2018-08-15 - 23:30 | almost 6 years |
4.4.3 | MIT | 4 | 2018-03-18 - 00:00 | about 6 years |
4.2.0 | MIT | 4 | 2016-07-01 - 17:45 | almost 8 years |
3.5.9 | MIT | 4 | 2016-05-03 - 02:47 | about 8 years |
3.5.5 | MIT | 4 | 2016-01-22 - 19:23 | over 8 years |
3.5.7 | MIT | 4 | 2016-04-18 - 14:59 | about 8 years |
3.5.8 | MIT | 4 | 2016-04-25 - 19:58 | about 8 years |
3.5.6 | MIT | 4 | 2016-02-01 - 11:10 | over 8 years |
3.5.4 | MIT | 4 | 2016-01-18 - 14:12 | over 8 years |
2.0.5 | UNKNOWN | 7 | 2013-01-28 - 14:49 | over 11 years |
2.0.0.rc | UNKNOWN | 7 | 2011-12-19 - 12:36 | over 12 years |
2.0.0.rc2 | UNKNOWN | 7 | 2012-01-24 - 13:29 | over 12 years |
2.0.6 | UNKNOWN | 7 | 2013-08-18 - 08:44 | almost 11 years |
2.1.0.rc | UNKNOWN | 7 | 2012-03-15 - 14:19 | about 12 years |
1.5.4 | UNKNOWN | 7 | 2013-01-28 - 14:49 | over 11 years |
1.5.0.rc1 | UNKNOWN | 7 | 2011-11-10 - 21:27 | over 12 years |
2.1.4 | UNKNOWN | 7 | 2013-08-18 - 08:38 | almost 11 years |
2.1.3 | UNKNOWN | 7 | 2013-01-28 - 14:49 | over 11 years |
3.0.0 | MIT | 7 | 2013-07-14 - 18:48 | almost 11 years |
2.1.0.rc2 | UNKNOWN | 7 | 2012-05-09 - 22:54 | about 12 years |
3.0.0.rc | MIT | 7 | 2013-05-07 - 16:35 | about 11 years |
2.2.8 | MIT | 6 | 2013-11-13 - 13:24 | over 10 years |
2.2.6 | MIT | 6 | 2013-08-09 - 08:32 | almost 11 years |
2.2.7 | MIT | 6 | 2013-08-18 - 08:29 | almost 11 years |
2.2.5 | MIT | 6 | 2013-08-02 - 21:24 | almost 11 years |
3.0.2 | MIT | 6 | 2013-08-09 - 08:24 | almost 11 years |
3.0.3 | MIT | 6 | 2013-08-18 - 08:26 | almost 11 years |
3.0.1 | MIT | 6 | 2013-08-02 - 21:25 | almost 11 years |
3.1.0.rc2 | MIT | 6 | 2013-08-18 - 08:18 | almost 11 years |
3.1.1 | MIT | 6 | 2013-10-01 - 15:51 | over 10 years |
3.1.2 | MIT | 6 | 2013-11-13 - 13:24 | over 10 years |
3.1.0 | MIT | 6 | 2013-09-05 - 22:50 | over 10 years |
3.0.4 | MIT | 6 | 2013-11-13 - 13:24 | over 10 years |
2.2.3 | UNKNOWN | 6 | 2013-01-28 - 14:49 | over 11 years |
2.2.4 | MIT | 6 | 2013-05-07 - 15:54 | about 11 years |
3.2.3 | MIT | 6 | 2014-02-20 - 18:33 | about 10 years |
3.3.0 | MIT | 6 | 2014-08-13 - 16:42 | almost 10 years |
3.4.0 | MIT | 6 | 2014-10-03 - 17:28 | over 9 years |
3.2.4 | MIT | 6 | 2014-03-17 - 14:16 | about 10 years |
3.2.2 | MIT | 6 | 2013-11-25 - 11:00 | over 10 years |
3.5.2 | MIT | 6 | 2015-08-10 - 12:47 | almost 9 years |
3.5.3 | MIT | 6 | 2015-12-10 - 16:37 | over 8 years |
3.5.1 | MIT | 6 | 2015-05-26 - 13:26 | almost 9 years |
3.4.1 | MIT | 6 | 2014-10-29 - 14:59 | over 9 years |
3.2.1 | MIT | 6 | 2013-11-13 - 13:25 | over 10 years |
3.2.0 | MIT | 6 | 2013-11-06 - 20:51 | over 10 years |
0.1.1 | UNKNOWN | 8 | 2009-10-21 - 20:07 | over 14 years |
1.1.rc1 | UNKNOWN | 8 | 2010-04-15 - 06:45 | about 14 years |
0.4.3 | UNKNOWN | 8 | 2009-11-10 - 03:01 | over 14 years |
0.1.0 | UNKNOWN | 8 | 2009-10-21 - 05:34 | over 14 years |
1.4.9 | UNKNOWN | 8 | 2011-10-20 - 14:50 | over 12 years |
1.4.8 | UNKNOWN | 8 | 2011-10-10 - 12:44 | over 12 years |
1.4.7 | UNKNOWN | 8 | 2011-09-22 - 09:51 | over 12 years |
1.4.5 | UNKNOWN | 8 | 2011-09-08 - 21:54 | over 12 years |
1.4.3 | UNKNOWN | 8 | 2011-08-30 - 12:43 | over 12 years |
1.4.2 | UNKNOWN | 8 | 2011-06-30 - 18:20 | almost 13 years |
1.4.1 | UNKNOWN | 8 | 2011-06-29 - 23:30 | almost 13 years |
1.3.4 | UNKNOWN | 8 | 2011-04-29 - 12:16 | about 13 years |
1.3.3 | UNKNOWN | 8 | 2011-04-21 - 17:19 | about 13 years |
1.3.2 | UNKNOWN | 8 | 2011-04-21 - 12:00 | about 13 years |
1.3.1 | UNKNOWN | 8 | 2011-04-19 - 08:40 | about 13 years |
1.3.0 | UNKNOWN | 8 | 2011-04-16 - 11:32 | about 13 years |
1.2.1 | UNKNOWN | 8 | 2011-03-28 - 18:52 | about 13 years |
1.2.0 | UNKNOWN | 8 | 2011-03-25 - 14:56 | about 13 years |
1.2.rc2 | UNKNOWN | 8 | 2011-03-11 - 19:57 | about 13 years |
1.2.rc | UNKNOWN | 8 | 2010-11-26 - 11:30 | over 13 years |
1.1.9 | UNKNOWN | 8 | 2011-03-25 - 14:52 | about 13 years |
1.1.8 | UNKNOWN | 8 | 2011-03-11 - 20:23 | about 13 years |
1.1.7 | UNKNOWN | 8 | 2011-02-16 - 20:04 | over 13 years |