PT-2016-3482 · Redis+1 · Redis+1
Denisvm
·
Published
2016-07-30
·
Updated
2024-06-15
·
CVE-2013-7458
CVSS v3.1
3.3
Low
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Redis versions prior to 3.2.3
Description
The issue allows local users to obtain sensitive information by reading a file. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited. Technical details about exploitation include the fact that the
linenoise component uses world-readable permissions for the .rediscli history file, allowing unauthorized access to sensitive data.Recommendations
For Redis versions prior to 3.2.3, update to version 3.2.3 or later to resolve the issue. As a temporary workaround, consider changing the permissions of the
.rediscli history file to restrict access until a patch is applied. Restrict access to the .rediscli history file to minimize the risk of exploitation.Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Redis