{"action":"Upgrade activerecord-session_store to 2.0.0 or later.","affected":[{"fixed":"2.0.0","introduced":"0"}],"component":"activerecord-session_store","cve_ids":["CVE-2019-25025"],"ecosystem":"RubyGems","epss":0.01835,"exploited":false,"fixed_versions":["2.0.0"],"ghsa_id":"GHSA-cvw2-xj8r-mjf7","id":"tcs_01M5KEJWG34ASF5F1JREAR7M8X","modified_at":"2024-02-16T08:10:03.472082Z","published_at":"2021-03-09T00:45:31Z","references":["https://osv.dev/vulnerability/GHSA-cvw2-xj8r-mjf7","https://nvd.nist.gov/vuln/detail/CVE-2019-25025","https://github.com/rails/activerecord-session_store/pull/151","https://github.com/rails/activerecord-session_store/commit/9d4dd113d3010b82daaadf0b0ee6b9fb2afb2160","https://github.com/rails/activerecord-session_store","https://github.com/rails/activerecord-session_store/releases/tag/v2.0.0","https://github.com/rubysec/ruby-advisory-db/blob/master/activerecord-session_store/CVE-2019-25025.yml","https://rubygems.org/gems/activerecord-session_store"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-cvw2-xj8r-mjf7","url":"https://osv.dev/vulnerability/GHSA-cvw2-xj8r-mjf7"}],"summary":"Activerecord-session_store Vulnerable to Timing Attack"}