Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
💎
💎 RubyGems
Not in CISA KEV
CRITICAL severity

Authentication Bypass by CSRF WeaknessGHSA-5629-8855-gf4g

CRITICAL

GHSA-5629-8855-gf4g is a critical-severity (CVSS 9.3) vulnerability in solidus_core. A fix is available for solidus_core — see the affected versions and patch details below.

Published
Updated
Affected
3 pkgs
Patched
3 / 3
Exploits
None indexed
Exploitation data as of Dec 2, 2024 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

3 pkgs affected
💎solidus_core💎solidus_core💎solidus_core

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems.

Description

Impact

The actual vulnerability has been discovered on solidus_auth_devise. See GHSA-xm34-v85h-9pg2 for details.

The security advisory here exists to provide an extra layer of security in the form of a monkey patch for users who don't update solidus_auth_devise. For this reason, it has been marked as low impact on this end.

Patches

For extra security, update solidus_core to versions 3.1.3, 3.0.3 or 2.11.12.

Workarounds

Look at the workarounds described at GHSA-xm34-v85h-9pg2.

References

For more information

If you have any questions or comments about this advisory:

Affected Packages

3 total 3 fixed
EcosystemPackageVulnerable rangeFix
💎RubyGemssolidus_coreall versions2.11.12bundle update solidus_core --conservative
💎RubyGemssolidus_core≥ 3.0.0&&< 3.0.33.0.3bundle update solidus_core --conservative
💎RubyGemssolidus_core≥ 3.1.0&&< 3.1.33.1.3bundle update solidus_core --conservative

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for solidus_core, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update solidus_core to 2.11.12 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-5629-8855-gf4g is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Impact The actual vulnerability has been discovered on `solidus_auth_devise`. See [GHSA-xm34-v85h-9pg2](https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2) for details. The security advisory here exists to provide an extra layer of security in the form of a monkey patch for users who don't update `solidus_auth_devise`. For this reason, it has been marked as low impact on this end. ### Patches For extra security, update `solidus_core` to versions `3.1.3`, `3.0.3` or `2.11.12`. ### Workarounds Look at the workarounds described at [GHSA-xm34-v85h-9pg2]
O3 Security · Impact-Aware SCA

Is GHSA-5629-8855-gf4g in your dependencies?

Find it across RubyGems, including transitive dependencies.

Scan my dependencies How O3 SCA works
Authentication Bypass by CSRF Weakness (Critical 9.3)