🔞 Theo@TheoMoff
@aerowide_ @FurryTMZ It doesn't make headlines because 70% of the internet isn't using it... Ruby on rails literally had a CVSS 9.8 in 2020... CVE-2020-8165 Aren't you a cybersecurity student?
1000025
10 followersView on X
CVE-2020-8165(debian / debian_linux)
LOWCVSS 9.8 · CRITICALImmediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.
0.5/ 10 priority
Sources & remediation
Patch / fix
Exploit / PoC references
Vendor / third-party advisories
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00034.html
- https://lists.debian.org/debian-lts-announce/2020/06/msg00022.html
- https://lists.debian.org/debian-lts-announce/2020/07/msg00013.html
- https://weblog.rubyonrails.org/2020/5/18/Rails-5-2-4-3-and-6-0-3-1-have-been-released/
Other references
Weakness type (CWE)
CWE-502
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
Are you affected?
If you run products in this scope, you should treat this CVE as relevant to your environment.
- debian_linux
- leap
- rails
Affected systems
Vendors
Products
debian_linuxleaprails
5 versions affected across 3 products
Deep dive
Full discourse1 post
CPE platform detail6 entries
6 of 6 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | debian | debian_linux | 10.0 | - | - |
| OS | debian | debian_linux | 8.0 | - | - |
| OS | debian | debian_linux | 9.0 | - | - |
| OS | opensuse | leap | 15.1 | - | - |
| OS | opensuse | leap | 15.2 | - | - |
| App | rubyonrails | rails | - | - | - |