crítica
CVE-2019-5421
Plataformatec Devise version 4.5.0 and earlier, using the lockable mod ...
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Ruby Advisory DB. Más baja según GHSA (media), Ubuntu (baja).
Descripción
Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in The `Devise::Models::Lockable` class, more specifically at the `#increment_failed_attempts` method. File location: lib/devise/models/lockable.rb that can result in Multiple concurrent requests can prevent an attacker from being blocked on brute force attacks. This attack appear to be exploitable via Network connectivity - brute force attacks. This vulnerability appears to have been fixed in 4.6.0 and later.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| rubygems::Ruby Advisory Database | devise | >= 4.6.0 |
| debian 11 | ruby-devise | 4.5.0-3 |
| debian 12 | ruby-devise | 4.5.0-3 |
| debian 9 | ruby-devise | sin corrección indicada |
| echo | ruby-devise | 4.5.0-3 |
| rubygems::GitHub Security Advisory RubyGems | devise | 4.6.0 |
| ubuntu 18.04-ESM | ruby-devise | sin corrección indicada |
| ubuntu 19.10 | ruby-devise | 4.5.0-3 |
| ubuntu 20.04 | ruby-devise | 4.5.0-3 |
| ubuntu 20.04-ESM | ruby-devise | 4.5.0-3 |
| ubuntu 20.10 | ruby-devise | 4.5.0-3 |
| ubuntu 21.04 | ruby-devise | 4.5.0-3 |
Mostrar las 20 entradas de 20 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| rubygems::Ruby Advisory Database | devise | >= 4.6.0 |
| debian 11 | ruby-devise | 4.5.0-3 |
| debian 12 | ruby-devise | 4.5.0-3 |
| debian 9 | ruby-devise | sin corrección indicada |
| echo | ruby-devise | 4.5.0-3 |
| rubygems::GitHub Security Advisory RubyGems | devise | 4.6.0 |
| ubuntu 18.04-ESM | ruby-devise | sin corrección indicada |
| ubuntu 19.10 | ruby-devise | 4.5.0-3 |
| ubuntu 20.04 | ruby-devise | 4.5.0-3 |
| ubuntu 20.04-ESM | ruby-devise | 4.5.0-3 |
| ubuntu 20.10 | ruby-devise | 4.5.0-3 |
| ubuntu 21.04 | ruby-devise | 4.5.0-3 |
| ubuntu 21.10 | ruby-devise | 4.5.0-3 |
| ubuntu 22.04 | ruby-devise | 4.5.0-3 |
| ubuntu 22.10 | ruby-devise | 4.5.0-3 |
| ubuntu 23.04 | ruby-devise | 4.5.0-3 |
| ubuntu 23.10 | ruby-devise | 4.5.0-3 |
| ubuntu 24.04 | ruby-devise | 4.5.0-3 |
| ubuntu 24.10 | ruby-devise | 4.5.0-3 |
| ubuntu 25.04 | ruby-devise | 4.5.0-3 |