OSVDB-112347 (activejob): Active Job - Object injection security vulnerability if Global IDs

September 29th, 2014

ADVISORIES

OSVDB-112347
Vendor Advisory

GEM

PATCHED VERSIONS

>= 4.2.0.beta2

DESCRIPTION

In release post: "Active Job vulnerability: We also fixed an Active Job bug that allowed String arguments to be deserialized as if they were Global IDs, an object injection security vulnerability.

RELATED