Skip to content

v3.2.9

Choose a tag to compare

View all tags
@petergoldstein petergoldstein released this 24 Sep 23:09
· 310 commits to main since this release
v3.2.9
3b82cd8

Security release. Fixes GHSA-6wmv-xq9m-fmp7, a memcached command injection through numeric arguments. Upgrading is recommended.

Security:

  • Fix memcached command injection through the incr/decr default with the meta protocol (GHSA-6wmv-xq9m-fmp7)
    • With protocol: :meta, the default argument of incr/decr was written into the command without conversion, so a String containing CRLF injected additional memcached commands (e.g. set, flush_all) on the connection. The default binary protocol is not affected
    • default must now be an Integer, or a String of decimal digits; anything else raises ArgumentError before a request is sent
    • As defense in depth, the meta RequestFormatter now converts every numeric flag it writes (D, J, N, T) to an Integer
    • Thanks to oss-security-shop for the report
Assets 2
Loading