PT-2024-39260 · Rubygems+3 · Devise-Two-Factor+3

Garrett Rappaport + 2 · Published 2024-09-17 · Updated 2024-10-01 · CVE-2024-8796

Positive Technologies (AI Summary)

CVSS v4.0

6.0

Medium

Base vector

AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Devise-Two-Factor versions 1.0.0 or >= 2.2.0 through < 6.0.0

Description: Under the default configuration, Devise-Two-Factor generates TOTP shared secrets that are 120 bits instead of the 128-bit minimum defined by RFC 4226. Using a shared secret shorter than the minimum to generate a multi-factor authentication code could make it easier for an attacker to guess the shared secret and generate valid TOTP codes.

Recommendations: For Devise-Two-Factor versions 1.0.0 or >= 2.2.0 through < 6.0.0, upgrade to version v6.0.0 as soon as possible. If upgrading is not possible, override the default otp secret length attribute in the model when configuring two factor authenticable and set it to a value of at least 26 to ensure newly generated shared secrets are at least 128-bits long. After upgrading or implementing the workaround, consider migrating users to the new OTP length to provide increased protection for those accounts. Implement application logic that checks the length of a user's shared secret and prompts users to re-enroll in OTP.

Fix

Weakness Enumeration

CWE-331

Related Identifiers

CVE-2024-8796

GHSA-QJXF-MC72-WJR2

USN-7050-1

Affected Products

Debian

Devise-Two-Factor

Linuxmint

Ubuntu

References · 16

• https://github.com/devise-two-factor/devise-two-factor/security/advisories/GHSA-qjxf-mc72-wjr2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-8796 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-8796 · Security Note
• https://osv.dev/vulnerability/CVE-2024-8796 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-8796 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7050-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qjxf-mc72-wjr2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-43177 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7050-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8796 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-8796 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-8796 · Vendor Advisory
• https://github.com/devise-two-factor/devise-two-factor · Note
• https://github.com/devise-two-factor/devise-two-factor/commit/cc6f34423d9c6af9f3e02be478c3c40dc7462e19 · Note
• https://twitter.com/CVEnew/status/1836095888202305729 · Twitter Post