PT-2023-2221 · Redis+4 · Redis+4

Yupeng Yang · Publicado 2023-03-20 · Atualizado 2025-10-21 · CVE-2023-28425

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Redis versions 7.0.8 through 7.0.9

Description The issue is related to the lack of input data sanitization in the Redis database management system. Exploitation of this issue may allow an attacker to send a specially crafted MSETNX command, causing a denial of service and terminating the Redis server process. Authenticated users can trigger a runtime assertion using the MSETNX command.

Recommendations For Redis versions 7.0.8 through 7.0.9, update to Redis version 7.0.10 to resolve the issue. As a temporary workaround, consider restricting access to the MSETNX command until a patch is available.

Exploit

Correção

Assertion Failure

Command Injection

Enumeração de Fraquezas

CWE-617

CWE-77

Identificadores relacionados

ALT-PU-2023-4982

ALT-PU-2025-11673

ALT-PU-2025-13204

AZL-25674

BDU:2023-01970

BIT-KEYDB-2023-28425

BIT-REDIS-2023-28425

BIT-VALKEY-2023-28425

CVE-2023-28425

GHSA-MVMM-4VQ6-VW8C

OPENSUSE-SU-2023_2925-1

OPENSUSE-SU-2024:12874-1

SUSE-SU-2023:2925-1

SUSE-SU-2023_2925-1

Produtos afetados

Alt Linux

Astra Linux

Red Os

Redis

Suse

Referências · 42

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28425.json · Exploit
• https://github.com/redis/redis/releases/tag/7.0.10 · Nota
• https://github.com/redis/redis/security/advisories/GHSA-mvmm-4vq6-vw8c · Aviso do Fabricante
• https://github.com/redis/redis/commit/48e0d4788434833b47892fe9f3d91be7687f25c9 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-28425 · Nota de Segurança
• https://osv.dev/vulnerability/AZL-25674 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-28425 · Aviso do Fabricante
• https://t.me/pentestingnews/34737 · Publicação no Telegram
• https://bugzilla.suse.com/1213193 · Nota
• https://t.me/cvenotify/46532 · Publicação no Telegram
• https://suse.com/security/cve/CVE-2023-25155 · Nota
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.8 · Nota
• https://t.me/cybersecuritytechnologies/8053 · Publicação no Telegram
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-28425 · Aviso do Fabricante
• https://bugzilla.suse.com/1208790 · Nota