The activerecord-session_store (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a correct guess in a relatively short amount of time. This is a related issue to CVE-2019-16782.
Proposed patch: https://github.com/rails/activerecord-session_store/pull/151 (Not merged into activerecord-session_store yet).
External References: https://github.com/advisories/GHSA-cvw2-xj8r-mjf7
The upstream fix for this has been merged and released as part of activerecord-session_store version 2.0.0. I think this can move states now.
This issue has been addressed in the following products: Red Hat Satellite 6.10 for RHEL 7 Via RHSA-2021:4702 https://access.redhat.com/errata/RHSA-2021:4702