description: A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.
problem types: Deserialization of Untrusted Data (CWE-502)
affected:
{
product: https://github.com/rails/rails
vendor: n/a
versions:
status: affected, version: Fixed in 5.2.4.3, 6.0.3.1
}