CVE-2023-27531.yml

---
gem: kredis
framework: rails
cve: 2023-27531
ghsa: h2wm-p2vg-6pw4
url: https://discuss.rubyonrails.org/t/cve-2023-27531-possible-deserialization-of-untrusted-data-vulnerability-in-kredis-json/82467#post_1
title: Possible Deserialization of Untrusted Data Vulnerability in Kredis JSON
date: 2023-03-13
description: |
  There is a deserialization of untrusted data vulnerability in
  the Kredis JSON deserialization code. This vulnerability has
  been assigned the CVE identifier CVE-2023-27531.

  'Not affected: None.'
  'Versions Affected: All.'
  'Fixed Versions: 1.3.0.1'

  Impact
    Carefully crafted JSON data processed by Kredis may result in
    deserialization of untrusted data, potentially leading to
    deserialization of unexpected objects in the system.

    Any applications using Kredis with JSON are affected.

  Releases
    The fixed releases are available at the normal locations.

  Workarounds
    There are no feasible workarounds for this issue.

  Patches
    To aid users who aren’t able to upgrade immediately we have
    provided patches for the two supported release series. They
    are in git-am format and consist of a single changeset.

    * 1-3-0-1-kredis.patch - Patch for 1.3.0 series

patched_versions:
  - ">= 1.3.0.1"
related:
  url:
    - https://discuss.rubyonrails.org/t/cve-2023-27531-possible-deserialization-of-untrusted-data-vulnerability-in-kredis-json/82467#post_1
    - https://github.com/rails/kredis/releases/tag/v1.3.0.1
    - https://my.diffend.io/gems/kredis/1.3.0/1.3.0.1
    - https://cve.report/CVE-2023-27531
    - https://github.com/jasnow/gsd-database/blob/main/2023/27xxx/GSD-2023-27531.json
notes: "CVE has be reserved, but not filled in."