UBUNTU-CVE-2015-7225
Dashboard / Vulnerabilities / UBUNTU-CVE-2015-7225
Summary:
Details: Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password (aka OTP), which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP through performing a man-in-the-middle attack between the provider and verifier, or shoulder surfing, and replaying the OTP in the current time-step.
References: https://ubuntu.com/security/CVE-2015-7225, http://www.openwall.com/lists/oss-security/2015/09/06/2, https://www.cve.org/CVERecord?id=CVE-2015-7225
Affected packages
Package
Name: ruby-devise-two-factor
Purl: pkg:deb/ubuntu/[email protected]?arch=source&distro=xenial
Affected ranges
Type: ECOSYSTEM
Events:
