Debian/ruby-devise: high 7.5
The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application access.
Action: Upgrade ruby-devise to 3.5.6-2 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.5.6-2 | - |
Fixed versions
| 3.5.6-2 |
Sources
published · modified · JSON