Vulnerability advisory

CVE-2020-8165

Published Jun 19, 2020Updated Oct 24, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/rails/rails ↗
All commits before 7b5cc5a5dfcf38522be0a4b5daa97c5b2ba26c20	`7b5cc5a5dfcf38522be0a4b5daa97c5b2ba26c20`
66cabeda2c46c582d19738e1318be8d59584cc5b to before 34991a6ae2fc68347c01ea7382fa89004159e019	`34991a6ae2fc68347c01ea7382fa89004159e019`
Also listed as affected (44) `v6.0.3` `v5.2.4.2` `v6.0.3.rc1` `v5.2.4.1` `v5.2.4` `v5.2.4.rc1` `v6.0.0` `v5.2.1.rc1` `v5.2.0.rc1` `v5.1.0.beta1` `v5.0.0.beta4` `v5.0.0.beta2` `v5.0.0.beta1` `v4.2.0.beta1` `v4.0.0.rc1` `v4.0.0.beta1` `v3.2.0.rc1` `v3.1.0.rc1` `v3.1.0.beta1` `v3.0.0.beta3` `v3.0.0.beta.3` `v2.0.1` `v2.0.0` `v2.0.0_RC2` `v2.0.0_RC1` `v2.0.0_PR` `v1.1.1` `v1.1.0` `v1.1.0_RC1` `v0.14.3` `v0.14.1` `v0.13.1` `v0.13.0` `v0.12.0` `v0.11.1` `v0.11.0` `v0.10.1` `v0.10.0` `v0.9.5` `v0.9.4.1` `v0.9.4` `v0.9.3` `v0.9.2` `v0.9.1`

Description

A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.

CVE-2020-8165

Affected versions

Repository

Description

References