Published: 02/03/2023 Updated: 10/03/2023

CVSS v3 Base Score: 6.5 | Impact Score: 3.6 | Exploitability Score: 2.8

VMScore: 0

Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. This problem affects all Redis versions. Patches were released in Redis version(s) 6.0.18, 6.2.11 and 7.0.9.

Vulnerable Product	Search on Vulmon	Subscribe to Product
redis redis

Debian Bug report logs - #1032279 redis: CVE-2023-25155 Package: src:redis; Maintainer for src:redis is Chris Lamb <lamby@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 2 Mar 2023 20:15:02 UTC Severity: important Tags: security, upstream Found in version redis/5:708-4 Reply or ...

Redis is an in-memory database that persists on disk Authenticated users issuing specially crafted `SETRANGE` and `SORT(_RO)` commands can trigger an integer overflow, resulting with Redis attempting to allocate impossible amounts of memory and abort with an out-of-memory (OOM) panic The problem is fixed in Redis versions 708, 629 and 6017 ...

DescriptionA vulnerability was found in Redis This flaw allows authenticated users issuing specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD commands to trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server processA vulnerability was found in Redis This flaw allows authenticated users i ...

Critical Infrastructure Sectors: Critical Manufacturing

CWE-190 https://github.com/redis/redis/releases/tag/6.2.11 https://github.com/redis/redis/security/advisories/GHSA-x2r7-j9vw-3w83 https://github.com/redis/redis/releases/tag/6.0.18 https://github.com/redis/redis/commit/2a2a582e7cd99ba3b531336b8bd41df2b566e619 https://github.com/redis/redis/releases/tag/7.0.9 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1032279 https://nvd.nist.gov https://www.cisa.gov/news-events/ics-advisories/icsa-24-046-11 https://alas.aws.amazon.com/AL2/ALASREDIS6-2023-001.html

CVE-2023-25155

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

ICS Advisories

References

Vulmon Search

About

Products

Connect