p PatchFirst

CVE-2023-28425

CVE-2023-28425 · Specially crafted MSETNX command can lead to denial-of-service

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Redis version 7.0.10.

CVSS 5.5 · Medium · EPSS 58.5% · Fix available

Published
Updated

Stack: system · database

Affected products and versions

  • redis

    Versions
    • >= 7.0.8, < 7.0.10: Affected

    No fix published

  • redis Debian:12

    Affected ranges
    • ECOSYSTEM: < 5:7.0.10-1

    Update to 5:7.0.10-1

  • redis Debian:13

    Affected ranges
    • ECOSYSTEM: < 5:7.0.10-1

    Update to 5:7.0.10-1

  • redis Debian:14

    Affected ranges
    • ECOSYSTEM: < 5:7.0.10-1

    Update to 5:7.0.10-1

Original sources

Check your server →