You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+23-4Lines changed: 23 additions & 4 deletions
Original file line number
Diff line number
Diff line change
@@ -112,9 +112,26 @@ information into the log, and it is required for security reason.
112
112
CVE-2015-9284 mitigation
113
113
--------------
114
114
115
-
Active Record Session Store in version 1.1.3 and below are affected by [CVE-2019-25025](https://github.com/advisories/GHSA-cvw2-xj8r-mjf7). This means an attacker can perform a timing attack against the session IDs stored in the database. This issue was resolved with `activerecord-session_store` version 1.1.4 thanks to [PR 151](https://github.com/rails/activerecord-session_store/pull/151). The fix contains a backwards compatibilty fallback that migrates affected sessions whenever they are used successfully.
116
-
However, as long those sessions exist in your database you are still affected by the security issue. Therefore it is strongly recommended not to rely on the fallback but to actively migrate the insecurely stored session IDs by calling the `#secure!` method on all sessions (see below for an example migration). Please be aware that you need to copy/adapt this method if you're using a custom class for storing your sessions (as described earlier in the `Configuration` part of this `README`).
117
-
The following example Active Record Migration will work for the default setup of this gem:
115
+
Active Record Session Store version 1.x and are affected by [CVE-2019-25025].
116
+
This means an attacker can perform a timing attack against the session IDs
117
+
stored in the database. This issue was resolved in version 2.0.0 thanks to
118
+
[#151]. The fix contains a backwards compatibilty fallback that migrates
119
+
affected sessions whenever they are used successfully.
@@ -129,7 +146,9 @@ class Cve201925025Mitigation < ActiveRecord::Migration[5.2]
129
146
end
130
147
```
131
148
132
-
After `rails db:migrate` is performed the session IDs are stored in the securely hashed format provided by `Rack::Session::SessionId`. The system is no longer affected by CVE-2015-9284.
149
+
After `rails db:migrate` is performed, the session IDs are stored in the
150
+
securely hashed format provided by `Rack::Session::SessionId` and no longer
0 commit comments