CVE-2020-8165

rubygem-activesupport: potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore

Published Jun 19, 2020 CVSS 3.1 · 9.8 Critical EPSS 45.7% KEV · Not listed
Description
A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-2251-1 rails security update
Debian DLA Debian DLA DLA-2282-1 rails security update
Debian DSA Debian DSA DSA-4766-1 rails security update
Github GHSA Github GHSA GHSA-2p68-f74v-9wc6 ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
Weaknesses

Sources

Status
PUBLISHED
Assigner
hackerone
Published
Updated
May 9, 2025, 8:03 PM
Reserved
Jan 28, 2020, 12:00 AM
Status
Modified
Published
Jun 19, 2020, 6:15 PM
Modified
Jun 17, 2026, 3:25 AM
Severity
Important
Public date
May 18, 2020, 12:00 AM