From 73f64b82999dfa9182b50e2b0347d19a3d8caa57 Mon Sep 17 00:00:00 2001 From: David Taylor Date: Mon, 15 Nov 2021 15:50:17 +0000 Subject: [PATCH] SECURITY: Ensure _forum_session cookies cannot be reused between sites (stable) (#14949) This only affects multisite Discourse instances (where multiple forums are served from a single application server). The vast majority of self-hosted Discourse forums do not fall into this category. On affected instances, this vulnerability could allow encrypted session cookies to be re-used between sites served by the same application instance. --- Gemfile.lock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Gemfile.lock b/Gemfile.lock index a9c0f4fe212..3a596db5e99 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -320,7 +320,7 @@ GEM activerecord (~> 6.0) concurrent-ruby railties (~> 6.0) - rails_multisite (3.0.0) + rails_multisite (4.0.0) activerecord (> 5.0, < 7) railties (> 5.0, < 7) railties (6.1.3.2)