PT-2023-6560 · Redis+10 · Redis+10
Al2Klimov
·
Publicado
2023-10-18
·
Atualizado
2026-05-18
·
CVE-2023-45145
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Redis versions prior to 6.2.14
Redis versions prior to 7.0.14
Redis versions prior to 7.2.2
Description
Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0-RC1.
Recommendations
For versions prior to 6.2.14, upgrade to version 6.2.14 or later.
For versions prior to 7.0.14, upgrade to version 7.0.14 or later.
For versions prior to 7.2.2, upgrade to version 7.2.2 or later.
As a temporary workaround, consider disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory.
Exploit
Correção
Exposure of Resource to Wrong Sphere
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Red Hat
Red Os
Redis
Rocky Linux
Suse
Ubuntu