USN-7050-1: Devise-Two-Factor vulnerabilities

Releases

• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS

Packages

• ruby-devise-two-factor - Barebones two-factor authentication with Devise

Details

Benoit Côté-Jodoin and Michael Nipper discovered that Devise-Two-Factor
incorrectly handled one-time password validation. An attacker could
possibly use this issue to intercept and re-use a one-time password.
(CVE-2021-43177)

Garrett Rappaport discovered that Devise-Two-Factor incorrectly handled
generating multi-factor authentication codes. An attacker could possibly
use this issue to generate valid multi-factor authentication codes.
(CVE-2024-8796)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 22.04

• ruby-devise-two-factor - 4.0.0-2ubuntu0.1~esm1
  Available with Ubuntu Pro

Ubuntu 20.04

• ruby-devise-two-factor - 3.1.0-2ubuntu0.1~esm1
  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References

• CVE-2021-43177
• CVE-2024-8796