redis-namespace Gem for Ruby contains a flaw in the method_missing implementation
Published: August 03, 2013
SECURITY IDENTIFIERS
- OSVDB: OSVDB-96425
- Vendor Advisory: http://blog.steveklabnik.com/posts/2013-08-03-redis-namespace-1-3-1--security-release
GEM
PATCHED VERSIONS
~> 1.0.4
~> 1.1.1
~> 1.2.2
>= 1.3.1
DESCRIPTION
redis-namespace Gem for Ruby contains a flaw in the method_missing implementation. The issue is triggered when handling exec commands called via send(). This may allow a remote attacker to execute arbitrary commands.