Unsanitized input leading to code injection in Dalli

GHSA-3xg8-cc8f-9wv2 · CVE-2022-4064

Published Nov 19, 2022 · Modified Nov 8, 2023

Description

A vulnerability was found in Dalli. Affected is the function self.meta_set of the file lib/dalli/protocol/meta/request_formatter.rb of the component Meta Protocol Handler. The manipulation leads to injection. The exploit has been disclosed to the public and may be used. The name of the patch is 48d594dae55934476fec61789e7a7c3700e0f50d. It is recommended to apply a patch to fix this issue.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2022-4064
WEB https://github.com/petergoldstein/dalli/issues/932
WEB https://github.com/petergoldstein/dalli/pull/933
WEB https://github.com/petergoldstein/dalli/commit/48d594dae55934476fec61789e7a7c3700e0f50d
PACKAGE https://github.com/petergoldstein/dalli
WEB https://github.com/rubysec/ruby-advisory-db/blob/master/gems/dalli/CVE-2022-4064.yml
WEB https://vuldb.com/?id.214026

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes