Bug 1843072 (CVE-2020-8165)

Summary:	CVE-2020-8165 rubygem-activesupport: potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	akarol, amackenz, amasferr, aos-bugs, bbuckingham, bcourt, bkearney, bmidwood, bmontgom, btotty, chazlett, cscribne, dmetzger, drieden, eparis, extras-orphan, gmccullo, gtanzill, hhudgeon, hvyas, jaruga, jburrell, jhardy, jokerman, jshepherd, kaycoth, lzap, mkudlej, mmccune, mo, nmoumoul, nstielau, pvalena, rchan, rjerrido, roliveri, ruby-packagers-sig, security-response-team, simaishi, smallamp, sokeeffe, sponnaga, sseago, strzibny, tjochec, vondruch, xlecauch
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	rubygem-activesupport 5.2.4.3, rubygem-activesupport 6.0.3.1	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in rubygem-activesupport. An untrusted user input can be written to the cache store using the `raw: true` parameter which can lead to the result being evaluated as a marshaled object instead of plain text. The threat from this vulnerability is to data confidentiality and integrity as well as system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-11-10 12:07:52 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1842995, 1842996, 1843073, 1843074, 1843497, 1844235, 1846377, 1972641
Bug Blocks:	1843075, 1997390

Description Guilherme de Almeida Suckevicz 2020-06-02 17:18:22 UTC

There is potentially unexpected behaviour in the MemCacheStore and RedisCacheStore where, when untrusted user input is written to the cache store using the `raw: true` parameter, re-reading the result from the cache can evaluate the user input as a marshalled object instead of plain text.

Reference:
https://groups.google.com/forum/#!msg/rubyonrails-security/bv6fW4S0Y1c/KnkEqM7AAQAJ

Comment 1 Guilherme de Almeida Suckevicz 2020-06-02 17:19:41 UTC

Created rubygem-activesupport tracking bugs for this issue:

Affects: epel-7 [bug 1843074]
Affects: fedora-all [bug 1843073]

Comment 5 Hardik Vyas 2020-06-03 12:26:52 UTC

External References:

https://groups.google.com/forum/#!msg/rubyonrails-security/bv6fW4S0Y1c/KnkEqM7AAQAJ

Comment 7 Hardik Vyas 2020-06-03 14:21:37 UTC

Upstream patches:

[6.0.3.1] https://github.com/rails/rails/commit/0a7ce52486adb36984174bd51257a0069fe7a9db
          https://github.com/rails/rails/commit/bd39a13cb9936e7261b271830950aae9bd0706bc
[5.2.4.3] https://github.com/rails/rails/commit/f7e077f85e61fc0b7381963eda0ceb0e457546b5
          https://github.com/rails/rails/commit/467e3399c9007996c03ffe3212689d48dd25ae99

Comment 15 Hardik Vyas 2020-06-15 13:15:29 UTC

Mitigation:

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Comment 17 Jason Shepherd 2020-08-04 04:38:23 UTC

Statement:

This issue affects the version of rubygem-activesupport as shipped with Red Hat Gluster Storage 3. However, the 'raw' option is not used by the product when storing untrusted user input and hence this issue has been rated as having a security impact of Low.

Red Hat Satellite ship affected RubyGem ActiveSupport and use RedisCacheStore, however, unmarshalling of user-provided objects is handled well in product code hence it is not vulnerable to the flaw. We may update the Ruby on Rails and rails-core dependency in a future release.

in OpenShift Container Platform 3.11, rubygem-activesupport is shipped, and it's included in the logging-fluentd container for use by rubygem-kubeclient [1]. The kubeclient gem does NOT make use of the vulnerable class, its only included for the inflector part of activesupport.