Skip to content

Commit 1973f37

Browse files
committed
Update styling in README.md
1 parent b1f36fb commit 1973f37

File tree

1 file changed

+23
-4
lines changed

1 file changed

+23
-4
lines changed

README.md

Lines changed: 23 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -112,9 +112,26 @@ information into the log, and it is required for security reason.
112112
CVE-2015-9284 mitigation
113113
--------------
114114

115-
Active Record Session Store in version 1.1.3 and below are affected by [CVE-2019-25025](https://github.com/advisories/GHSA-cvw2-xj8r-mjf7). This means an attacker can perform a timing attack against the session IDs stored in the database. This issue was resolved with `activerecord-session_store` version 1.1.4 thanks to [PR 151](https://github.com/rails/activerecord-session_store/pull/151). The fix contains a backwards compatibilty fallback that migrates affected sessions whenever they are used successfully.
116-
However, as long those sessions exist in your database you are still affected by the security issue. Therefore it is strongly recommended not to rely on the fallback but to actively migrate the insecurely stored session IDs by calling the `#secure!` method on all sessions (see below for an example migration). Please be aware that you need to copy/adapt this method if you're using a custom class for storing your sessions (as described earlier in the `Configuration` part of this `README`).
117-
The following example Active Record Migration will work for the default setup of this gem:
115+
Active Record Session Store version 1.x and are affected by [CVE-2019-25025].
116+
This means an attacker can perform a timing attack against the session IDs
117+
stored in the database. This issue was resolved in version 2.0.0 thanks to
118+
[#151]. The fix contains a backwards compatibilty fallback that migrates
119+
affected sessions whenever they are used successfully.
120+
121+
[CVE-2019-25025]: https://github.com/advisories/GHSA-cvw2-xj8r-mjf7
122+
[#151]: https://github.com/rails/activerecord-session_store/pull/151
123+
124+
However, as long those sessions exist in your database you are still affected
125+
by the security issue. Therefore it is strongly recommended not to rely on the
126+
fallback but to actively migrate the insecurely stored session IDs by calling
127+
the `#secure!` method on all sessions.
128+
129+
Please be aware that you need to copy/adapt this method if you're using a
130+
custom class for storing your sessions (as described earlier in the
131+
`Configuration` part of this `README`).
132+
133+
The following example Active Record Migration will work for the default setup
134+
of this gem:
118135

119136
```ruby
120137
# db/migrate/20210310083511_cve201925025_mitigation.rb
@@ -129,7 +146,9 @@ class Cve201925025Mitigation < ActiveRecord::Migration[5.2]
129146
end
130147
```
131148

132-
After `rails db:migrate` is performed the session IDs are stored in the securely hashed format provided by `Rack::Session::SessionId`. The system is no longer affected by CVE-2015-9284.
149+
After `rails db:migrate` is performed, the session IDs are stored in the
150+
securely hashed format provided by `Rack::Session::SessionId` and no longer
151+
vulnerable to CVE-2019-25025.
133152

134153
Contributing to Active Record Session Store
135154
--------------

0 commit comments

Comments
 (0)