Dalli: Code Injection — GLSA 202405-03

A vulnerability has been discovered in Dalli, which can lead to code injection.

Affected packages

Package	dev-ruby/dalli on all architectures
Affected versions	< 3.2.3
Unaffected versions	>= 3.2.3

Background

Dalli is a high performance pure Ruby client for accessing memcached servers.

Description

A vulnerability was found in Dalli. Affected is the function self.meta_set of the file lib/dalli/protocol/meta/request_formatter.rb of the component Meta Protocol Handler. The manipulation leads to injection.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All Dalli users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=dev-ruby/dalli-3.2.3"

References

CVE-2022-4064

Release date
May 04, 2024

Latest revision
May 04, 2024: 1

Severity
normal

Exploitable
local and remote

Bugzilla entries

882077