Description
A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a https://github.com/rails/rails
Fixed in 5.2.4.3, 6.0.3.1affected
References
- https://hackerone.com/reports/413388 ↗
- https://groups.google.com/g/rubyonrails-security/c/bv6fW4S0Y1c ↗
- https://lists.debian.org/debian-lts-announce/2020/06/msg00022.html ↗
- https://weblog.rubyonrails.org/2020/5/18/Rails-5-2-4-3-and-6-0-3-1-have-been-released/ ↗
- https://lists.debian.org/debian-lts-announce/2020/07/msg00013.html ↗
- https://www.debian.org/security/2020/dsa-4766 ↗
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00031.html ↗
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00034.html ↗
- https://security.netapp.com/advisory/ntap-20250509-0002/ ↗