p PatchFirst

CVE-2023-28856

CVE-2023-28856 · `HINCRBYFLOAT` can be used to crash a redis-server process

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Redis is an open source, in-memory database that persists on disk. Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access in affected versions. This issue has been addressed in in versions 7.0.11, 6.2.12, and 6.0.19. Users are advised to upgrade. There are no known workarounds for this issue.

CVSS 5.5 · Medium · EPSS 1.3% · Fix available

Published
Updated

Stack: system · database

Affected products and versions

  • redis

    Versions
    • >= 7.0.0, < 7.0.11: Affected
    • >= 6.2.0, < 6.2.12: Affected
    • < 6.0.19: Affected

    No fix published

  • redis Debian:12

    Affected ranges
    • ECOSYSTEM: < 5:7.0.11-1

    Update to 5:7.0.11-1

  • redis Debian:13

    Affected ranges
    • ECOSYSTEM: < 5:7.0.11-1

    Update to 5:7.0.11-1

  • redis Debian:14

    Affected ranges
    • ECOSYSTEM: < 5:7.0.11-1

    Update to 5:7.0.11-1

  • redis Ubuntu:Pro:14.04:LTS

    Versions
    • 2:2.6.13-1
    • 2:2.6.16-3
    • 2:2.8.0-1
    • 2:2.8.2-1
    • 2:2.8.4-2
    • 2:2.8.4-2ubuntu0.2
    • 2:2.8.4-2ubuntu0.2+esm1
    • 2:2.8.4-2ubuntu0.2+esm2
    Affected ranges
    • ECOSYSTEM: < 2:2.8.4-2ubuntu0.2+esm3

    Update to 2:2.8.4-2ubuntu0.2+esm3

  • redis Ubuntu:Pro:16.04:LTS

    Versions
    • 2:3.0.3-3
    • 2:3.0.5-1
    • 2:3.0.5-2
    • 2:3.0.5-3
    • 2:3.0.5-4
    • 2:3.0.6-1
    • 2:3.0.6-1ubuntu0.2
    • 2:3.0.6-1ubuntu0.3
    • 2:3.0.6-1ubuntu0.4
    • 2:3.0.6-1ubuntu0.4+esm1
    Affected ranges
    • ECOSYSTEM: < 2:3.0.6-1ubuntu0.4+esm2

    Update to 2:3.0.6-1ubuntu0.4+esm2

  • redis Ubuntu:Pro:18.04:LTS

    Versions
    • 4:4.0.1-7
    • 4:4.0.2-6
    • 4:4.0.2-9
    • 5:4.0.5-1
    • 5:4.0.6-1
    • 5:4.0.6-2
    • 5:4.0.7-1
    • 5:4.0.8-1
    • 5:4.0.8-2
    • 5:4.0.9-1
    • 5:4.0.9-1ubuntu0.1
    • 5:4.0.9-1ubuntu0.2
    • 5:4.0.9-1ubuntu0.2+esm2
    • 5:4.0.9-1ubuntu0.2+esm3
    Affected ranges
    • ECOSYSTEM: < 5:4.0.9-1ubuntu0.2+esm4

    Update to 5:4.0.9-1ubuntu0.2+esm4

  • redis Ubuntu:Pro:20.04:LTS

    Versions
    • 5:5.0.5-2build1
    • 5:5.0.6-1
    • 5:5.0.7-1
    • 5:5.0.7-2
    • 5:5.0.7-2ubuntu0.1~esm1
    • 5:5.0.7-2ubuntu0.1
    • 5:5.0.7-2ubuntu0.1+esm1
    Affected ranges
    • ECOSYSTEM: < 5:5.0.7-2ubuntu0.1+esm2

    Update to 5:5.0.7-2ubuntu0.1+esm2

  • redis Ubuntu:Pro:22.04:LTS

    Versions
    • 5:6.0.15-1
    • 5:6.0.16-1
    • 5:6.0.16-1build1
    • 5:6.0.16-1ubuntu1
    Affected ranges
    • ECOSYSTEM: < 5:6.0.16-1ubuntu1+esm1

    Update to 5:6.0.16-1ubuntu1+esm1

Original sources

Check your server →