Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
184 results · page 3 of 4
Mar 26, 2023redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrCVE-2023-28858 · Other software · Redis · reported by MITRELow 3.7
redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request in an off-by-one manner. NOTE: this CVE Record was initially created in response to reports about ChatGPT, and 4.3.6, 4.4.3, and 4.5.3 were released (changing the behavior for pipeline operations); however, please see CVE-2023-28859 about addressing data leakage across AsyncIO connections in general.
- Product
- Redis-py
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2023Redis is an in-memory database that persists on disk.CVE-2023-28425 · Other software · redis · reported by GitHubMedium 5.5
Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Redis version 7.0.10.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023Redis is an in-memory database that persists on disk.CVE-2023-25155 · Other software · redis · reported by GitHubMedium 5.5
Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. This problem affects all Redis versions. Patches were released in Redis version(s) 6.0.18, 6.2.11 and 7.0.9.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023Redis is an in-memory database that persists on disk.CVE-2022-36021 · Other software · redis · reported by GitHubMedium 5.5
Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. The problem is fixed in Redis versions 6.0.18, 6.2.11, 7.0.9.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2023Redis is an in-memory database that persists on disk.CVE-2023-22458 · Other software · redis · reported by GitHubMedium 5.5
Redis is an in-memory database that persists on disk. Authenticated users can issue a `HRANDFIELD` or `ZRANDMEMBER` command with specially crafted arguments to trigger a denial-of-service by crashing Redis with an assertion failure. This problem affects Redis versions 6.2 or newer up to but not including 6.2.9 as well as versions 7.0 up to but not including 7.0.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2023Redis is an in-memory database that persists on disk.CVE-2022-35977 · Other software · redis · reported by GitHubMedium 5.5
Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SETRANGE` and `SORT(_RO)` commands can trigger an integer overflow, resulting with Redis attempting to allocate impossible amounts of memory and abort with an out-of-memory (OOM) panic. The problem is fixed in Redis versions 7.0.8, 6.2.9 and 6.0.17. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2022A vulnerability, which was classified as problematic, was found in phpRedisAdmin up to 1.17.3.CVE-2021-4268 · Other software · unspecified · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in phpRedisAdmin up to 1.17.3. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 1.18.0 is able to address this issue. The name of the patch is b9039adbb264c81333328faa9575ecf8e0d2be94. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216471.
- Product
- phpRedisAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2022A vulnerability was found in phpRedisAdmin up to 1.16.1.CVE-2021-4259 · Websites & servers · Phpredisadmin Project · reported by VulDBMedium 5
A vulnerability was found in phpRedisAdmin up to 1.16.1. It has been classified as problematic. This affects the function authHttpDigest of the file includes/login.inc.php. The manipulation of the argument response leads to use of wrong operator in string comparison. Upgrading to version 1.16.2 is able to address this issue. The name of the patch is 31aa7661e6db6f4dffbf9a635817832a0a11c7d9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216267.
- Product
- Phpredisadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022A vulnerability was found in a port or fork of Redis.CVE-2022-3734 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability was found in a port or fork of Redis. It has been declared as critical. This vulnerability affects unknown code in the library C:/Program Files/Redis/dbghelp.dll. The manipulation leads to uncontrolled search path. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The identifier of this vulnerability is VDB-212416. NOTE: The official Redis release is not affected. This issue might affect an unofficial fork or port on Windows only.
- Product
- Redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2022** DISPUTED ** A vulnerability, which was classified as problematic, was found in Redis up to 6.2.7/7.0.5.CVE-2022-3647 · Other software · Redis · reported by VulDBLow 3.1
** DISPUTED ** A vulnerability, which was classified as problematic, was found in Redis up to 6.2.7/7.0.5. Affected is the function sigsegvHandler of the file debug.c of the component Crash Report. The manipulation leads to denial of service. The complexity of an attack is rather high. The exploitability is told to be difficult. The real existence of this vulnerability is still doubted at the moment. Upgrading to version 6.2.8 and 7.0.6 is able to address this issue. The patch is identified as 0bf90d944313919eb8e63d3588bf63a367f020a3. It is recommended to apply a patch to fix this issue. VDB-211962 is the identifier assigned to this vulnerability. NOTE: The vendor claims that this is not a DoS because it applies to the crash logging mechanism which is triggered after a crash has occurred.
- Product
- Redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2022Bifrost is a heterogeneous middleware that synchronizes MySQL, MariaDB to Redis, MongoDB, ClickHouse, MySQL and other services for production environments.CVE-2022-39267 · Other software · brokercap · reported by GitHubHigh 8.8
Bifrost is a heterogeneous middleware that synchronizes MySQL, MariaDB to Redis, MongoDB, ClickHouse, MySQL and other services for production environments. Versions prior to 1.8.8-release are subject to authentication bypass in the admin and monitor user groups by deleting the X-Requested-With: XMLHttpRequest field in the request header. This issue has been patched in 1.8.8-release. There are no known workarounds.
- Product
- Bifrost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2022`@next-auth/upstash-redis-adapter` is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.js.CVE-2022-39263 · Other software · nextauthjs · reported by GitHubMedium 6.8
`@next-auth/upstash-redis-adapter` is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.js. Applications that use `next-auth` Email Provider and `@next-auth/upstash-redis-adapter` before v3.0.2 are affected by this vulnerability. The Upstash Redis adapter implementation did not check for both the identifier (email) and the token, but only checking for the identifier when verifying the token in the email callback flow. An attacker who knows about the victim's email could easily sign in as the victim, given the attacker also knows about the verification token's expired duration. The vulnerability is patched in v3.0.2. A workaround is available. Using Advanced Initialization, developers can check the requests and compare the query's token and identifier before proceeding.
- Product
- next-auth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2022Redis is an in-memory database that persists on disk.CVE-2022-35951 · Other software · redis · reported by GitHubHigh 7
Redis is an in-memory database that persists on disk. Versions 7.0.0 and above, prior to 7.0.5 are vulnerable to an Integer Overflow. Executing an `XAUTOCLAIM` command on a stream key in a specific state, with a specially crafted `COUNT` argument may cause an integer overflow, a subsequent heap overflow, and potentially lead to remote code execution. This has been patched in Redis version 7.0.5. No known workarounds exist.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Sep 2, 2022NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database.CVE-2022-36076 · Other software · NodeBB · reported by GitHubHigh 8.8
NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. Due to an unnecessarily strict conditional in the code handling the first step of the SSO process, the pre-existing logic that added (and later checked) a nonce was inadvertently rendered opt-in instead of opt-out. This re-exposed a vulnerability in that a specially crafted Man-in-the-Middle (MITM) attack could theoretically take over another user account during the single sign-on process. The issue has been fully patched in version 1.17.2.
- Product
- NodeBB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblogs.opera.comgithub.com
Aug 31, 2022NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database.CVE-2022-36045 · Other software · NodeBB · reported by GitHubCritical 9
NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. It utilizes web sockets for instant interactions and real-time notifications. `utils.generateUUID`, a helper function available in essentially all versions of NodeBB (as far back as v1.0.1 and potentially earlier) used a cryptographically insecure Pseudo-random number generator (`Math.random()`), which meant that a specially crafted script combined with multiple invocations of the password reset functionality could enable an attacker to correctly calculate the reset code for an account they do not have access to. This vulnerability impacts all installations of NodeBB. The vulnerability allows for an attacker to take over any account without the involvement of the victim, and as such, the remediation should be applied immediately (either via NodeBB upgrade or cherry-pick of the specific changeset. The vulnerability has been patched in version 2.x and 1.19.x. There is no known workaround, but the patch sets listed above will fully patch the vulnerability.
- Product
- NodeBB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2022A flaw was found in CryptoPro Secure Disk bootloaders before 2022-06-01.CVE-2022-34301 · Other software · Kidan · reported by MITREMedium 6.7
A flaw was found in CryptoPro Secure Disk bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbitrary code in the pre-boot stage, an attacker simply needs to replace the existing signed bootloader currently in use with this bootloader. Access to the EFI System Partition is required for booting using external media.
- Product
- Cryptopro Securedisk For Bitlocker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordedk2-docs.gitbook.iointel.com
Jul 19, 2022Redis is an in-memory database that persists on disk.CVE-2022-31144 · Other software · redis · reported by GitHubHigh 7
Redis is an in-memory database that persists on disk. A specially crafted `XAUTOCLAIM` command on a stream key in a specific state may result with heap overflow, and potentially remote code execution. This problem affects versions on the 7.x branch prior to 7.0.4. The patch is released in version 7.0.4.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022Redis v7.0 was discovered to contain a memory leak via the component streamGetEdgeID.CVE-2022-33105 · Other software · Redis · reported by MITREHigh 7.5
Redis v7.0 was discovered to contain a memory leak via the component streamGetEdgeID.
- Product
- Redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2022Redis is an in-memory database that persists on disk.CVE-2022-24736 · Other software · redis · reported by GitHubLow 3.3
Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. The problem is fixed in Redis versions 7.0.0 and 6.2.7. An additional workaround to mitigate this problem without patching the redis-server executable, if Lua scripting is not being used, is to block access to `SCRIPT LOAD` and `EVAL` commands using ACL rules.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2022Redis is an in-memory database that persists on disk.CVE-2022-24735 · Other software · redis · reported by GitHubLow 3.9
Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis prior to version 7.0.0 or 6.2.7 can inject Lua code that will execute with the (potentially higher) privileges of another Redis user. The Lua script execution environment in Redis provides some measures that prevent a script from creating side effects that persist and can affect the execution of the same, or different script, at a later time. Several weaknesses of these measures have been publicly known for a long time, but they had no security impact as the Redis security model did not endorse the concept of users or privileges. With the introduction of ACLs in Redis 6.0, these weaknesses can be exploited by a less privileged users to inject Lua code that will execute at a later time, when a privileged user executes a Lua script. The problem is fixed in Redis versions 7.0.0 and 6.2.7. An additional workaround to mitigate this problem without patching the redis-server executable, if Lua scripting is not being used, is to block access to `SCRIPT LOAD` and `EVAL` commands using ACL rules.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2022Debian-specific Redis Server Lua Sandbox Escape VulnerabilityCVE-2022-0543 · Other software · Redis · reported by security@debian.orgExploitedCritical 10
Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
- Product
- Debian-specific Redis Servers
- On CISA’s list since
- Mar 28, 2022 (federal fix deadline Apr 18, 2022)
- What to do
- Attackers are using this now. Install Redis’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.combugs.debian.org
Nov 29, 2021Workerman-ThinkPHP-Redis (last update Mar 16, 2018) is affected by a Cross Site Scripting (XSS) vulnerability.CVE-2021-43697 · Other software · Workerman-thinkphp-redis Project · reported by MITREMedium 6.1
Workerman-ThinkPHP-Redis (last update Mar 16, 2018) is affected by a Cross Site Scripting (XSS) vulnerability. In file Controller.class.php, the exit function will terminate the script and print the message to the user. The message will contain $_GET{C('VAR_JSONP_HANDLER')] then there is a XSS vulnerability.
- Product
- Workerman-thinkphp-redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2021AS_Redis is an AntSword plugin for Redis.CVE-2021-41172 · Other software · Medicean · reported by GitHubMedium 6.4
AS_Redis is an AntSword plugin for Redis. The Redis Manage plugin for AntSword prior to version 0.5 is vulnerable to Self-XSS due to due to insufficient input validation and sanitization via redis server configuration. Self-XSS in the plugin configuration leads to code execution. This issue is patched in version 0.5.
- Product
- AS_Redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021Hiredis is a minimalistic C client library for the Redis database.CVE-2021-32765 · Other software · redis · reported by GitHubHigh 8.8
Hiredis is a minimalistic C client library for the Redis database. In affected versions Hiredis is vulnurable to integer overflow if provided maliciously crafted or corrupted `RESP` `mult-bulk` protocol data. When parsing `multi-bulk` (array-like) replies, hiredis fails to check if `count * sizeof(redisReply*)` can be represented in `SIZE_MAX`. If it can not, and the `calloc()` call doesn't itself make this check, it would result in a short allocation and subsequent buffer overflow. Users of hiredis who are unable to update may set the [maxelements](https://github.com/redis/hiredis#reader-max-array-elements) context option to a value small enough that no overflow is possible.
- Product
- hiredis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021Redis is an open source, in-memory database that persists on disk.CVE-2021-41099 · Other software · redis · reported by GitHubHigh 7.5
Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the underlying string library can be used to corrupt the heap and potentially result with denial of service or remote code execution. The vulnerability involves changing the default proto-max-bulk-len configuration parameter to a very large value and constructing specially crafted network payloads or commands. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the proto-max-bulk-len configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021Redis is an open source, in-memory database that persists on disk.CVE-2021-32762 · Other software · redis · reported by GitHubHigh 7.5
Redis is an open source, in-memory database that persists on disk. The redis-cli command line tool and redis-sentinel service may be vulnerable to integer overflow when parsing specially crafted large multi-bulk network replies. This is a result of a vulnerability in the underlying hiredis library which does not perform an overflow check before calling the calloc() heap allocation function. This issue only impacts systems with heap allocators that do not perform their own overflow checks. Most modern systems do and are therefore not likely to be affected. Furthermore, by default redis-sentinel uses the jemalloc allocator which is also not vulnerable. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021Redis is an open source, in-memory database that persists on disk.CVE-2021-32687 · Other software · redis · reported by GitHubHigh 7.5
Redis is an open source, in-memory database that persists on disk. An integer overflow bug affecting all versions of Redis can be exploited to corrupt the heap and potentially be used to leak arbitrary contents of the heap or trigger remote code execution. The vulnerability involves changing the default set-max-intset-entries configuration parameter to a very large value and constructing specially crafted commands to manipulate sets. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the set-max-intset-entries configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021Redis is an open source, in-memory database that persists on disk.CVE-2021-32675 · Other software · redis · reported by GitHubHigh 7.5
Redis is an open source, in-memory database that persists on disk. When parsing an incoming Redis Standard Protocol (RESP) request, Redis allocates memory according to user-specified values which determine the number of elements (in the multi-bulk header) and size of each element (in the bulk header). An attacker delivering specially crafted requests over multiple connections can cause the server to allocate significant amount of memory. Because the same parsing mechanism is used to handle authentication requests, this vulnerability can also be exploited by unauthenticated users. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. An additional workaround to mitigate this problem without patching the redis-server executable is to block access to prevent unauthenticated users from connecting to Redis. This can be done in different ways: Using network access control tools like firewalls, iptables, security groups, etc. or Enabling TLS and requiring users to authenticate using client side certificates.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021Redis is an open source, in-memory database that persists on disk.CVE-2021-32672 · Other software · redis · reported by GitHubMedium 5.3
Redis is an open source, in-memory database that persists on disk. When using the Redis Lua Debugger, users can send malformed requests that cause the debugger’s protocol parser to read data beyond the actual buffer. This issue affects all versions of Redis with Lua debugging support (3.2 or newer). The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021Redis is an open source, in-memory database that persists on disk.CVE-2021-32628 · Other software · redis · reported by GitHubHigh 7.5
Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the ziplist data structure used by all versions of Redis can be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves modifying the default ziplist configuration parameters (hash-max-ziplist-entries, hash-max-ziplist-value, zset-max-ziplist-entries or zset-max-ziplist-value) to a very large value, and then constructing specially crafted commands to create very large ziplists. The problem is fixed in Redis versions 6.2.6, 6.0.16, 5.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the above configuration parameters. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021Redis is an open source, in-memory database that persists on disk.CVE-2021-32627 · Other software · redis · reported by GitHubHigh 7.5
Redis is an open source, in-memory database that persists on disk. In affected versions an integer overflow bug in Redis can be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves changing the default proto-max-bulk-len and client-query-buffer-limit configuration parameters to very large values and constructing specially crafted very large stream elements. The problem is fixed in Redis 6.2.6, 6.0.16 and 5.0.14. For users unable to upgrade an additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the proto-max-bulk-len configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021Redis is an open source, in-memory database that persists on disk.CVE-2021-32626 · Other software · redis · reported by GitHubHigh 7.5
Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can cause the heap-based Lua stack to be overflowed, due to incomplete checks for this condition. This can result with heap corruption and potentially remote code execution. This problem exists in all versions of Redis with Lua scripting support, starting from 2.6. The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14. For users unable to update an additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2021A segmentation fault in the redis-server component of Redis 5.0.7 leads to a denial of service (DOS).CVE-2020-21468 · Other software · Redislabs · reported by MITREHigh 7.5
A segmentation fault in the redis-server component of Redis 5.0.7 leads to a denial of service (DOS). NOTE: the vendor cannot reproduce this issue in a released version, such as 5.0.7.
- Product
- Redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2021Redis is an in-memory database that persists on disk.CVE-2021-32761 · Other software · redis · reported by GitHubHigh 7.5
Redis is an in-memory database that persists on disk. A vulnerability involving out-of-bounds read and integer overflow to buffer overflow exists starting with version 2.2 and prior to versions 5.0.13, 6.0.15, and 6.2.5. On 32-bit systems, Redis `*BIT*` command are vulnerable to integer overflow that can potentially be exploited to corrupt the heap, leak arbitrary heap contents or trigger remote code execution. The vulnerability involves changing the default `proto-max-bulk-len` configuration parameter to a very large value and constructing specially crafted commands bit commands. This problem only affects Redis on 32-bit platforms, or compiled as a 32-bit binary. Redis versions 5.0.`3m 6.0.15, and 6.2.5 contain patches for this issue. An additional workaround to mitigate the problem without patching the `redis-server` executable is to prevent users from modifying the `proto-max-bulk-len` configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jun 24, 2021In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerable to remote code executeCVE-2021-31649 · Other software · Jfinal · reported by MITRECritical 9.8
In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerable to remote code execute
- Product
- Jfinal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.youdao.comnote.youdao.com
Jun 2, 2021Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker.CVE-2021-32625 · Other software · redis · reported by GitHubHigh 7.5
Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer, could be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477. The problem is fixed in version 6.2.4 and 6.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the STRALGO LCS command. On 64 bit systems which have the fixes of CVE-2021-29477 (6.2.3 or 6.0.13), it is sufficient to make sure that the proto-max-bulk-len config parameter is smaller than 2GB (default is 512MB).
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2021IBM Planning Analytics Local 2.0 connects to a Redis server.CVE-2020-4670 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.1
IBM Planning Analytics Local 2.0 connects to a Redis server. The Redis server, an in-memory data structure store, running on the remote host is not protected by password authentication. A remote attacker can exploit this to gain unauthorized access to the server. IBM X-Force ID: 186401.
- Product
- Planning Analytics Local
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
May 4, 2021Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker.CVE-2021-29478 · Other software · redis · reported by GitHubHigh 7.5
Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis 6.2 before 6.2.3 could be exploited to corrupt the heap and potentially result with remote code execution. Redis 6.0 and earlier are not directly affected by this issue. The problem is fixed in version 6.2.3. An additional workaround to mitigate the problem without patching the `redis-server` executable is to prevent users from modifying the `set-max-intset-entries` configuration parameter. This can be done using ACL to restrict unprivileged users from using the `CONFIG SET` command.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
May 4, 2021Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker.CVE-2021-29477 · Other software · redis · reported by GitHubHigh 7.5
Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer could be exploited using the `STRALGO LCS` command to corrupt the heap and potentially result with remote code execution. The problem is fixed in version 6.2.3 and 6.0.13. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the `STRALGO LCS` command.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Apr 23, 2021Node-redis is a Node.js Redis client.CVE-2021-29469 · Other software · NodeRedis · reported by GitHubMedium 5.3
Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. The issue is patched in version 3.1.1.
- Product
- node-redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2021A heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when using a heap allocator other than jemalloc or glibc's malCVE-2021-3470 · Other software · Redislabs · reported by Red HatMedium 5.3
A heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when using a heap allocator other than jemalloc or glibc's malloc, leading to potential out of bound write or process crash. Effectively this flaw does not affect the vast majority of users, who use jemalloc or glibc malloc.
- Product
- Redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Mar 26, 2021In all versions of GitLab, marshalled session keys were being stored in Redis.CVE-2021-22194 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.7
In all versions of GitLab, marshalled session keys were being stored in Redis.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2021Redis is an open-source, in-memory database that persists on disk.CVE-2021-21309 · Other software · redis · reported by GitHubMedium 5.4
Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer overflow scenarios, which would result with buffer overflow and heap corruption. We believe this could in certain conditions be exploited for remote code execution. By default, authenticated Redis users have access to all configuration parameters and can therefore use the “CONFIG SET proto-max-bulk-len” to change the safe default, making the system vulnerable. **This problem only affects 32-bit Redis (on a 32-bit system, or as a 32-bit executable running on a 64-bit system).** The problem is fixed in version 6.2, and the fix is back ported to 6.0.11 and 5.0.11. Make sure you use one of these versions if you are running 32-bit Redis. An additional workaround to mitigate the problem
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2021GigaVUE-OS (GVOS) 5.4 - 5.9 stores a Redis database password in plaintext.CVE-2020-23249 · Other software · Gigamon · reported by MITREMedium 4.7
GigaVUE-OS (GVOS) 5.4 - 5.9 stores a Redis database password in plaintext.
- Product
- Gigavue-os
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.gigamon.comcommunity.gigamon.com
Dec 23, 2020RedisGraph 2.x through 2.2.11 has a NULL Pointer Dereference that leads to a server crash because it mishandles an unquoted string, such as an alias that has noCVE-2020-35668 · Other software · Redislabs · reported by MITREHigh 7.5
RedisGraph 2.x through 2.2.11 has a NULL Pointer Dereference that leads to a server crash because it mishandles an unquoted string, such as an alias that has not yet been introduced.
- Product
- Redisgraph
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2020phpRedisAdmin before 1.13.2 allows XSS via the login.php username parameter.CVE-2020-27163 · Websites & servers · Phpredisadmin Project · reported by MITREMedium 6.1
phpRedisAdmin before 1.13.2 allows XSS via the login.php username parameter.
- Product
- Phpredisadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2020An integer overflow in the getnum function in lua_struct.c in Redis before 6.0.3 allows context-dependent attackers with permission to run Lua code in a Redis sCVE-2020-14147 · Other software · Redislabs · reported by MITREHigh 7.7
An integer overflow in the getnum function in lua_struct.c in Redis before 6.0.3 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow. NOTE: this issue exists because of a CVE-2015-8080 regression.
- Product
- Redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orggithub.com
Apr 2, 2020The Redis data structure component used in ABB eSOMS versions 6.0 to 6.0.2 stores credentials in clear text.CVE-2019-19096 · Other software · ABB · reported by cybersecurity@ch.abb.comMedium 6.1
The Redis data structure component used in ABB eSOMS versions 6.0 to 6.0.2 stores credentials in clear text. If an attacker has file system access, this can potentially compromise the credentials' confidentiality.
- Product
- eSOMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsearch.abb.comsearch.abb.com
Jan 15, 2020async.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a NULL pointer dereference because malloc return values are unchecked.CVE-2020-7105 · Other software · Redislabs · reported by MITREHigh 7.5
async.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a NULL pointer dereference because malloc return values are unchecked.
- Product
- Hiredis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Nov 1, 2019Insecure temporary file vulnerability in Redis 2.6 related to /tmp/redis.ds.CVE-2013-0180 · Other software · Redis Labs · reported by Red HatMedium 5.5
Insecure temporary file vulnerability in Redis 2.6 related to /tmp/redis.ds.
- Product
- Redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.combugzilla.redhat.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.