There is potentially unexpected behaviour in the MemCacheStore and RedisCacheStore where, when untrusted user input is written to the cache store using the `raw: true` parameter, re-reading the result from the cache can evaluate the user input as a marshalled object instead of plain text. Reference: https://groups.google.com/forum/#!msg/rubyonrails-security/bv6fW4S0Y1c/KnkEqM7AAQAJ
Created rubygem-activesupport tracking bugs for this issue: Affects: epel-7 [bug 1843074] Affects: fedora-all [bug 1843073]
External References: https://groups.google.com/forum/#!msg/rubyonrails-security/bv6fW4S0Y1c/KnkEqM7AAQAJ
Upstream patches: [6.0.3.1] https://github.com/rails/rails/commit/0a7ce52486adb36984174bd51257a0069fe7a9db https://github.com/rails/rails/commit/bd39a13cb9936e7261b271830950aae9bd0706bc [5.2.4.3] https://github.com/rails/rails/commit/f7e077f85e61fc0b7381963eda0ceb0e457546b5 https://github.com/rails/rails/commit/467e3399c9007996c03ffe3212689d48dd25ae99
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Statement: This issue affects the version of rubygem-activesupport as shipped with Red Hat Gluster Storage 3. However, the 'raw' option is not used by the product when storing untrusted user input and hence this issue has been rated as having a security impact of Low. Red Hat Satellite ship affected RubyGem ActiveSupport and use RedisCacheStore, however, unmarshalling of user-provided objects is handled well in product code hence it is not vulnerable to the flaw. We may update the Ruby on Rails and rails-core dependency in a future release. in OpenShift Container Platform 3.11, rubygem-activesupport is shipped, and it's included in the logging-fluentd container for use by rubygem-kubeclient [1]. The kubeclient gem does NOT make use of the vulnerable class, its only included for the inflector part of activesupport.