redis: CVE-2023-28425

Debian Bug report logs - #1033340
redis: CVE-2023-28425

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: redis: CVE-2023-28425

Date: Wed, 22 Mar 2023 22:37:57 +0100

Source: redis
Version: 5:7.0.9-1
Severity: grave
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for redis.

Note this is not strictly speaking RC severity for the CVE issue, but
it's only present in unstable, so let's avoid it might go to testing.

Speaking of redis and bookworm, with the fix here applied, can you
have a look at the regessions, and help redis migrate to testing?

CVE-2023-28425[0]:
| Redis is an in-memory database that persists on disk. Starting in
| version 7.0.8 and prior to version 7.0.10, authenticated users can use
| the MSETNX command to trigger a runtime assertion and termination of
| the Redis server process. The problem is fixed in Redis version
| 7.0.10.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-28425
    https://www.cve.org/CVERecord?id=CVE-2023-28425
[1] https://github.com/redis/redis/security/advisories/GHSA-mvmm-4vq6-vw8c

Regards,
Salvatore

Send a report that this bug log contains spam.