Vulnerability CVE-2023-25155: Information
Description
Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. This problem affects all Redis versions. Patches were released in Redis version(s) 6.0.18, 6.2.11 and 7.0.9.
Severity: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Fixed packages
Package name | Branch | Fixed in version | Version from repository | Errata ID | Task # | State |
|---|---|---|---|---|---|---|
| redis | sisyphus | 7.0.12-alt1 | 7.2.4-alt1.1 | ALT-PU-2023-4982-3 | 327278 | Fixed |
| redis | sisyphus_e2k | 7.0.12-alt1 | 7.2.4-alt1.1 | ALT-PU-2023-5079-1 | - | Fixed |
| redis | sisyphus_riscv64 | 7.2.0-alt0.port | 7.2.4-alt0.port | ALT-PU-2023-5217-1 | - | Fixed |
| redis | p10 | 6.2.13-alt1 | 6.2.14-alt1 | ALT-PU-2023-5230-3 | 327639 | Fixed |
| redis | p10_e2k | 6.2.13-alt1 | 6.2.14-alt1 | ALT-PU-2023-5452-1 | - | Fixed |
| redis | c10f1 | 6.2.13-alt1 | 6.2.13-alt1 | ALT-PU-2023-5229-3 | 327640 | Fixed |
| redis | c9f2 | 6.2.13-alt1 | 6.2.13-alt1 | ALT-PU-2023-5487-2 | 328853 | Fixed |
References to Advisories, Solutions, and Tools
Hyperlink | Resource |
|---|---|
| https://github.com/redis/redis/releases/tag/6.2.11 |
|
| https://github.com/redis/redis/security/advisories/GHSA-x2r7-j9vw-3w83 |
|
| https://github.com/redis/redis/releases/tag/6.0.18 |
|
| https://github.com/redis/redis/commit/2a2a582e7cd99ba3b531336b8bd41df2b566e619 |
|
| https://github.com/redis/redis/releases/tag/7.0.9 |
|