{"id":"CVE-2017-1000248","aliases":["DEBIAN-CVE-2017-1000248","EUVD-2017-0357","GHSA-2w67-526p-gm73","UBUNTU-CVE-2017-1000248"],"status":"published","title":"redis-store deserializes untrusted data","description":"Redis-store \u003c=v1.3.0 allows unsafe objects to be loaded from redis","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01983,"percentile":0.80706,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502"],"published":"2017-11-17T04:00:00Z","modified":"2026-10-20T10:47:33Z","fixes":[{"ecosystem":"RubyGems","package":"redis-store","fixed_in":["1.4.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"ruby-redis-store","fixed_in":["1.1.6-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-redis-store","fixed_in":["1.1.6-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-redis-store","fixed_in":["1.1.6-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"ruby-redis-store","fixed_in":["1.1.6-1+deb9u1build0.16.04.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"redis-store","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-redis-store","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.6-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-redis-store","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.6-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-redis-store","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.6-2"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"redis-store","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0"}]}],"versions":["0.3.6","0.3.7","0.3.8","0.3.9","1.0.0.1","1.0.0.beta1","1.0.0.beta2","1.0.0.beta3","1.0.0.beta4","1.0.0.beta5","1.0.0.rc1","1.1.0","1.1.0.rc","1.1.0.rc2","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.1.7","1.2.0","1.2.0.pre","1.3.0"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ruby-redis-store","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.6-1+deb9u1build0.16.04.1"}]}],"versions":["1.1.6-1"]}],"products":[{"vendor":"redis-store","product":"redis-store"}],"references":[{"url":"https://github.com/redis-store/redis-store/commit/e0c1398d54a9661c8c70267c3a925ba6b192142e","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000248","tags":["advisory"]},{"url":"https://github.com/redis-store/redis-store/commit/ce13252c26fcc40ed4935c9abfeb0ee0761e5704","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/redis-store/CVE-2017-1000248.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2w67-526p-gm73"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-1000248","tags":["advisory"]},{"url":"https://github.com/redis-store/redis-store","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2017-1000248","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-1000248","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-1000248","description":"Redis-store \u003c=v1.3.0 allows unsafe objects to be loaded from redis","status":"published","published":"2017-11-17T04:00:00Z","modified":"2024-09-17T01:27:04.226Z","updated_at":"2026-11-02T14:33:20.843976Z"}],"euvd":[{"id":"EUVD-2017-0357","description":"Redis-store \u003c=v1.3.0 allows unsafe objects to be loaded from redis","status":"published","published":"2017-11-17T04:00:00Z","modified":"2024-09-17T01:27:04Z","updated_at":"2026-11-03T00:28:49.329777Z"}],"ghsa":[{"id":"GHSA-2w67-526p-gm73","title":"redis-store deserializes untrusted data","description":"Redis-store prior to 1.4.0 allows unsafe objects to be loaded from redis","status":"published","published":"2017-12-06T16:41:25Z","modified":"2023-08-28T10:28:46Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:37:00.680009Z"}],"nvd":[{"id":"CVE-2017-1000248","description":"Redis-store \u003c=v1.3.0 allows unsafe objects to be loaded from redis","status":"published","published":"2017-11-17T04:29:00.577Z","modified":"2026-06-17T00:58:58.74Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:04:08.635428Z"}],"osv":[{"id":"CVE-2017-1000248","description":"Redis-store \u003c=v1.3.0 allows unsafe objects to be loaded from redis","status":"published","published":"2017-11-17T04:29:00.577Z","modified":"2026-10-20T10:47:33.307164165Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:03.851821Z"},{"id":"DEBIAN-CVE-2017-1000248","description":"Redis-store \u003c=v1.3.0 allows unsafe objects to be loaded from redis","status":"published","published":"2017-11-17T04:29:00.577Z","modified":"2026-09-01T20:03:40.496017459Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:28.207321Z"},{"id":"GHSA-2w67-526p-gm73","title":"redis-store deserializes untrusted data","description":"Redis-store prior to 1.4.0 allows unsafe objects to be loaded from redis","status":"published","published":"2017-12-06T16:41:25Z","modified":"2024-02-16T08:24:25.597076Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:34.700741Z"},{"id":"UBUNTU-CVE-2017-1000248","description":"Redis-store \u003c=v1.3.0 allows unsafe objects to be loaded from redis","status":"published","published":"2017-11-17T04:29:00Z","modified":"2025-07-18T16:44:20Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:13.729565Z"}]}}