Lucene search

K
rubygemsRubySecRUBY:AUDITED-2024-22047
HistoryApr 30, 2023 - 9:00 p.m.

Race Condition leading to logging errors

2023-04-3021:00:00
RubySec
github.com
16
race condition
audited library
logging errors
threaded web servers
version 5.3.3
security fix

CVSS3

3.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

7

Confidence

Low

In certain setups with threaded web servers, Audited’s use of
Thread.current can incorrectly attributed audits to the wrong user.

Fixed in 5.3.3.

In March, @convisoappsec noticed that the library in question had a
Race Condition problem, which caused logs to be registered at times
with different users than those who performed the genuine actions.

Affected configurations

Vulners
Node
rubyauditedRange5.3.3
VendorProductVersionCPE
rubyaudited*cpe:2.3:a:ruby:audited:*:*:*:*:*:*:*:*

CVSS3

3.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

7

Confidence

Low