Red Hat memcached cache plugin of the community: remote code execution

A flaw was found in the memcached cache plugin of the community.general Ansible

collection. Although its documentation states that records are stored in JSON

format, the plugin performs no explicit serialization and relies on

python-memcached, which pickles values on write and unpickles them on read.

Because memcached is unauthenticated and cache keys are predictable, an attacker

able to reach a network-exposed or shared memcached instance can write a crafted

pickle payload that is deserialized and executed on the Ansible controller when

the poisoned fact cache is next read, leading to remote code execution.