CVE catalog

CVE-2021-43177

ruby-devise-two-factor: CVE-2021-43177

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.88% · Oct 25, 2026

As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianruby-devise-two-factorbookworm4.0.2-1fixed
Ubunturuby-devise-two-factorpro3.1.0-2vulnerable
Ubunturuby-devise-two-factorpro4.0.0-2vulnerable
Ubunturuby-devise-two-factorpro4.0.0-2ubuntu0.1~esm1fixed
Ubunturuby-devise-two-factor16.041.1.0-1vulnerable
Ubunturuby-devise-two-factor16.042.0.0-1vulnerable
Ubunturuby-devise-two-factorpro3.1.0-2vulnerable
Ubunturuby-devise-two-factorpro4.0.0-2vulnerable
Ubunturuby-devise-two-factorpro4.0.0-2ubuntu0.1~esm1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianruby-devise-two-factorsourcebookworm4.0.2-1not yet assignedNot reported[1009636]
Ubunturuby-devise-two-factordebpro4.0.0-2ubuntu0.1~esm1Not reportedUSN-7050-1Not reported
Ubunturuby-devise-two-factordebpro4.0.0-2ubuntu0.1~esm1Not reportedUBUNTU-CVE-2021-43177Not reported

[Debian bug #1009636]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [ruby-devise-two-factor]Fixed
    Details (2)

    • 4.0.2-1 · all · bookworm

      Fixed · Fixed: 4.0.2-1

      dsa · ruby-devise-two-factor · debian · bookworm; dsa · ruby-devise-two-factor · debian · 12

    • 4.0.2-1 · all · bookworm

      Fixed · Fixed: 4.0.2-1

      dsa · ruby-devise-two-factor · debian · bookworm; dsa · ruby-devise-two-factor · debian · 12

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]