Skip to content

Dalli security warning #1038

@philayres

Description

@philayres

The log displays the following during startup:

SECURITY WARNING: Dalli is using Marshal for serialization. Marshal can execute arbitrary code during deserialization. If your memcached server could be compromised, consider using a safer serializer like JSON: Dalli::Client.new(servers, serializer: JSON)

If our memcached server is compromised, the whole server has been compromised. Dalli doesn't amplify the issues in this case.

To resolve, this warning should be squashed somehow.

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or requestsecuritySecurity issue or CVE in dependency

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions