Published: 20/01/2023 Updated: 02/02/2023

CVSS v3 Base Score: 5.5 | Impact Score: 3.6 | Exploitability Score: 1.8

VMScore: 0

Redis is an in-memory database that persists on disk. Authenticated users can issue a `HRANDFIELD` or `ZRANDMEMBER` command with specially crafted arguments to trigger a denial-of-service by crashing Redis with an assertion failure. This problem affects Redis versions 6.2 or newer up to but not including 6.2.9 as well as versions 7.0 up to but not including 7.0.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Vulnerable Product	Search on Vulmon	Subscribe to Product
redis redis

Debian Bug report logs - #1029363 redis: CVE-2023-22458: Integer overflow in the Redis HRANDFIELD and ZRANDMEMBER commands may lead to denial-of-service Package: src:redis; Maintainer for src:redis is Chris Lamb <lamby@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 21 Jan 2023 20:30:01 U ...

Redis is an in-memory database that persists on disk Authenticated users issuing specially crafted `SETRANGE` and `SORT(_RO)` commands can trigger an integer overflow, resulting with Redis attempting to allocate impossible amounts of memory and abort with an out-of-memory (OOM) panic The problem is fixed in Redis versions 708, 629 and 6017 ...

DescriptionA flaw was found in Redis, an in-memory database that persists on disk This flaw allows authenticated users to issue an `HRANDFIELD` or `ZRANDMEMBER` command with specially crafted arguments to trigger a denial-of-service by crashing Redis with an assertion failureA flaw was found in Redis, an in-memory database that persists on ...

CWE-190 https://github.com/redis/redis/security/advisories/GHSA-r8w2-2m53-gprj https://github.com/redis/redis/commit/16f408b1a0121cacd44cbf8aee275d69dc627f02 https://github.com/redis/redis/releases/tag/6.2.9 https://github.com/redis/redis/releases/tag/7.0.8 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1029363 https://nvd.nist.gov https://alas.aws.amazon.com/AL2/ALASREDIS6-2023-001.html

CVE-2023-22458

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect