Active Job - Object injection security vulnerability if Global IDs
Published: September 29, 2014
SECURITY IDENTIFIERS
- GHSA: GHSA-mpwp-4h2m-765c
- OSVDB: OSVDB-112347
GEM
FRAMEWORK
PATCHED VERSIONS
>= 4.2.0.beta2
DESCRIPTION
Active Job vulnerability: An Active Job bug allowed String arguments to be deserialized as if they were Global IDs, an object injection security vulnerability.
- In release post: "Active Job vulnerability: We also fixed an Active Job bug that allowed String arguments to be deserialized as if they were Global IDs, an object injection security vulnerability.