CVE-2017-1000248 (redis-store): Unsafe objects can be loaded from Redis

November 16th, 2017

ADVISORIES

GEM

SEVERITY

CVSS v3.x: 9.8 (Critical)

PATCHED VERSIONS

>= 1.4.0

DESCRIPTION

Redis-store <=v1.3.0 allows unsafe objects to be loaded from Redis via the use of the Marshal serializer.