GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

GSD-2019-5421

Vulnerability from gsd - Updated: 2019-02-07 00:00
Details
Devise ruby gem before 4.6.0 when the `lockable` module is used is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to `increment_failed_attempts` within the `Devise::Models::Lockable` class not being concurrency safe.
Aliases
Aliases
CVE-2019-5421
To clipboard 

{
  "GSD": {
    "alias": "CVE-2019-5421",
    "description": "Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in The `Devise::Models::Lockable` class, more specifically at the `#increment_failed_attempts` method. File location: lib/devise/models/lockable.rb that can result in Multiple concurrent requests can prevent an attacker from being blocked on brute force attacks. This attack appear to be exploitable via Network connectivity - brute force attacks. This vulnerability appears to have been fixed in 4.6.0 and later.",
    "id": "GSD-2019-5421"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "devise",
            "purl": "pkg:gem/devise"
          }
        }
      ],
      "aliases": [
        "CVE-2019-5421",
        "GHSA-73rf-6mrf-759q"
      ],
      "details": "Devise ruby gem before 4.6.0 when the `lockable` module is used is vulnerable to a\ntime-of-check time-of-use (TOCTOU) race condition due to `increment_failed_attempts`\nwithin the `Devise::Models::Lockable` class not being concurrency safe.\n",
      "id": "GSD-2019-5421",
      "modified": "2019-02-07T00:00:00.000Z",
      "published": "2019-02-07T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://github.com/plataformatec/devise/issues/4981"
        }
      ],
      "schema_version": "1.4.0",
      "severity": [
        {
          "score": 7.5,
          "type": "CVSS_V2"
        },
        {
          "score": 9.8,
          "type": "CVSS_V3"
        }
      ],
      "summary": "Devise Gem for Ruby Time-of-check Time-of-use race condition with lockable module"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "support@hackerone.com",
        "ID": "CVE-2019-5421",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Devise ruby gem",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "4.5.0 and earlier using the lockable module"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Plataformatec"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in The `Devise::Models::Lockable` class, more specifically at the `#increment_failed_attempts` method. File location: lib/devise/models/lockable.rb that can result in Multiple concurrent requests can prevent an attacker from being blocked on brute force attacks. This attack appear to be exploitable via Network connectivity - brute force attacks. This vulnerability appears to have been fixed in 4.6.0 and later."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/plataformatec/devise/issues/4981",
            "refsource": "MISC",
            "url": "https://github.com/plataformatec/devise/issues/4981"
          },
          {
            "name": "https://github.com/plataformatec/devise/pull/4996",
            "refsource": "MISC",
            "url": "https://github.com/plataformatec/devise/pull/4996"
          }
        ]
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2019-5421",
      "cvss_v2": 7.5,
      "cvss_v3": 9.8,
      "date": "2019-02-07",
      "description": "Devise ruby gem before 4.6.0 when the `lockable` module is used is vulnerable to a\ntime-of-check time-of-use (TOCTOU) race condition due to `increment_failed_attempts`\nwithin the `Devise::Models::Lockable` class not being concurrency safe.\n",
      "gem": "devise",
      "ghsa": "73rf-6mrf-759q",
      "patched_versions": [
        "\u003e= 4.6.0"
      ],
      "title": "Devise Gem for Ruby Time-of-check Time-of-use race condition with lockable module",
      "url": "https://github.com/plataformatec/devise/issues/4981"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c=4.5.0",
          "affected_versions": "All versions up to 4.5.0",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-307",
            "CWE-937"
          ],
          "date": "2019-10-09",
          "description": "Using the lockable module contains a vulnerability that can result in multiple concurrent requests can prevent an attacker from being blocked on brute force attacks.",
          "fixed_versions": [
            "4.6.0"
          ],
          "identifier": "CVE-2019-5421",
          "identifiers": [
            "CVE-2019-5421"
          ],
          "not_impacted": "All versions after 4.5.0",
          "package_slug": "gem/devise",
          "pubdate": "2019-04-03",
          "solution": "Upgrade to version 4.6.0 or above.",
          "title": "Time-of-check Time-of-use (TOCTOU) Race Condition",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2019-5421",
            "https://github.com/plataformatec/devise/issues/4981"
          ],
          "uuid": "6302c127-b32f-4e1c-9ff9-249e116a236a"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:plataformatec:devise:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "4.5.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve-assignments@hackerone.com",
          "ID": "CVE-2019-5421"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in The `Devise::Models::Lockable` class, more specifically at the `#increment_failed_attempts` method. File location: lib/devise/models/lockable.rb that can result in Multiple concurrent requests can prevent an attacker from being blocked on brute force attacks. This attack appear to be exploitable via Network connectivity - brute force attacks. This vulnerability appears to have been fixed in 4.6.0 and later."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-307"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/plataformatec/devise/pull/4996",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/plataformatec/devise/pull/4996"
            },
            {
              "name": "https://github.com/plataformatec/devise/issues/4981",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Issue Tracking",
                "Third Party Advisory"
              ],
              "url": "https://github.com/plataformatec/devise/issues/4981"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2020-10-16T19:17Z",
      "publishedDate": "2019-04-03T15:29Z"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.