A vulnerability has been discovered in Dalli, which can lead to code injection.

Announced

2024-05-04

Revised

2024-05-04

Access

local and remote

Bugs

#882077

Advisory

https://security.gentoo.org/glsa/202405-03

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-ruby/dalli	*	< 3.2.3	>= 3.2.3

Background

Dalli is a high performance pure Ruby client for accessing memcached servers.

Description

A vulnerability was found in Dalli. Affected is the function self.meta_set of the file lib/dalli/protocol/meta/request_formatter.rb of the component Meta Protocol Handler. The manipulation leads to injection.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All Dalli users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-ruby/dalli-3.2.3"

References

• CVE-2022-4064