CVE-2023-27531

RubyGems/kredis CVE-2023-27531: medium 5.3, EPSS 0.54%

Kredis JSON Possible Deserialization of Untrusted Data Vulnerability

Action: Upgrade kredis to 1.3.0.1 or later.

bundle update kredis

Affected

Fixed versions

Sources

• osv: GHSA-h2wm-p2vg-6pw4
• https://nvd.nist.gov/vuln/detail/CVE-2023-27531
• https://github.com/rails/kredis/commit/d576b7ae5c8d3d74eeb4bd84cad0aa64ffc299fa
• https://discuss.rubyonrails.org/t/cve-2023-27531-possible-deserialization-of-untrusted-data-vulnerability-in-kredis-json/82467
• https://discuss.rubyonrails.org/t/cve-2023-27531-possible-deserialization-of-untrusted-data-vulnerability-in-kredis-json/82467#post_1
• https://github.com/rails/kredis
• https://github.com/rails/kredis/releases/tag/v1.3.0.1
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/kredis/CVE-2023-27531.yml

CVE-2023-27531 · published 2023-06-09T22:40:54Z · modified 2025-01-10T18:47:40.903534Z · JSON