CVE-2023-25155mediumCWE-190

Integer Overflow in several Redis commands can lead to denial of service.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.5epss 0.9%

probabilidad de explotación

0.9%top 44% de las CVE

explotación observada

noninguna fuente lo reporta

Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. This problem affects all Redis versions. Patches were released in Redis version(s) 6.0.18, 6.2.11 and 7.0.9.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Productos afectados

redis · redis

Referencias

https://github.com/redis/redis/commit/2a2a582e7cd99ba3b531336b8bd41df2b566e619 https://github.com/redis/redis/releases/tag/6.0.18 https://github.com/redis/redis/releases/tag/6.2.11 https://github.com/redis/redis/releases/tag/7.0.9 https://github.com/redis/redis/security/advisories/GHSA-x2r7-j9vw-3w83