CVE-2023-22458
CVE-2023-22458 · Integer overflow in multiple Redis commands can lead to denial-of-service
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Redis is an in-memory database that persists on disk. Authenticated users can issue a `HRANDFIELD` or `ZRANDMEMBER` command with specially crafted arguments to trigger a denial-of-service by crashing Redis with an assertion failure. This problem affects Redis versions 6.2 or newer up to but not including 6.2.9 as well as versions 7.0 up to but not including 7.0.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS 5.5 · Media · EPSS 72,0% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: system · database
Productos y versiones afectados
redis
- Versiones
- >= 6.2, < 6.2.9: Afectada
- >= 7.0, < 7.0.8: Afectada
Sin corrección publicada
redis Debian:12
- Intervalos de versiones afectados
- ECOSYSTEM: < 5:7.0.8-1
Actualiza a 5:7.0.8-1
redis Debian:13
- Intervalos de versiones afectados
- ECOSYSTEM: < 5:7.0.8-1
Actualiza a 5:7.0.8-1
redis Debian:14
- Intervalos de versiones afectados
- ECOSYSTEM: < 5:7.0.8-1
Actualiza a 5:7.0.8-1