PT-2025-5971 · Apache · Apache Kvrocks

Sergey Volosatov · Publicado 2025-02-07 · Atualizado 2025-07-16 · CVE-2025-25069

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Kvrocks versions 1.0 through 2.11.0

Description A Cross-Protocol Scripting vulnerability is found in Apache Kvrocks. Since Kvrocks did not detect if Host: or POST appears in RESP requests, a valid HTTP request can also be sent to Kvrocks as a valid RESP request and trigger some database operations, which can be dangerous when chained with SSRF. This issue is similar to a previously identified vulnerability in Redis.

Recommendations For Apache Kvrocks versions 1.0 through 2.11.0, upgrade to version 2.11.1, which fixes the issue. As a temporary workaround, consider restricting access to the database operations that can be triggered by the vulnerability until the update is applied.

Correção

Enumeração de Fraquezas

CWE-115

Identificadores relacionados

CVE-2025-25069

Produtos afetados

Apache Kvrocks

Referências · 10

• https://osv.dev/vulnerability/CVE-2025-25069 · Aviso do Fabricante
• https://lists.apache.org/thread/gbxv9gpsskmdzg6z48zm3tvo8cyo9v3t · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2016-10517 · Nota de Segurança
• https://twitter.com/oss_security/status/1888052143166206301 · Publicação no Twitter
• https://t.me/cvedetector/17492 · Publicação no Telegram
• https://t.me/cvenotify/111315 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1887848109360795942 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1887964725452943395 · Publicação no Twitter
• https://t.me/cvenotify/129167 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-25069 · Nota de Segurança