search

rails / activerecord-session_store

Active Record's Session Store extracted from Rails
MIT License
541 stars 188 forks source link

Fix CVE in README #177

Closed marvinthepa closed 3 years ago

marvinthepa commented 3 years ago

CVE-2015-9284 is an old CSRF Bug in Omniauth, has nothing to do with CVE-2019-25025 which is a timing attack against session ids.

sikachu commented 3 years ago

🤦‍♂️ thank you very much.

I'll update release note and everything for this correction.

thorsteneckel commented 3 years ago

I'm really sorry - that was my fault. I copied the wrong CVE from our bundle-audit exclusion 🤦‍♂️ Thanks for looking out @marvinthepa and sorry for the extra work @sikachu