PT-2023-2221 · Redis+4 · Redis+4

Yupeng Yang · Published 2023-03-20 · Updated 2025-10-21 · CVE-2023-28425

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Redis versions 7.0.8 through 7.0.9

Description The issue is related to the lack of input data sanitization in the Redis database management system. Exploitation of this issue may allow an attacker to send a specially crafted MSETNX command, causing a denial of service and terminating the Redis server process. Authenticated users can trigger a runtime assertion using the MSETNX command.

Recommendations For Redis versions 7.0.8 through 7.0.9, update to Redis version 7.0.10 to resolve the issue. As a temporary workaround, consider restricting access to the MSETNX command until a patch is available.

Exploit

Fix

Assertion Failure

Command Injection

Weakness Enumeration

CWE-617

CWE-77

Related Identifiers

ALT-PU-2023-4982

ALT-PU-2025-11673

ALT-PU-2025-13204

AZL-25674

BDU:2023-01970

BIT-KEYDB-2023-28425

BIT-REDIS-2023-28425

BIT-VALKEY-2023-28425

CVE-2023-28425

GHSA-MVMM-4VQ6-VW8C

OPENSUSE-SU-2023_2925-1

OPENSUSE-SU-2024:12874-1

SUSE-SU-2023:2925-1

SUSE-SU-2023_2925-1

Affected Products

Alt Linux

Astra Linux

Red Os

Redis

Suse

References · 42

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28425.json · Exploit
• https://github.com/redis/redis/security/advisories/GHSA-mvmm-4vq6-vw8c · Vendor Advisory
• https://github.com/redis/redis/commit/48e0d4788434833b47892fe9f3d91be7687f25c9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-28425 · Security Note
• https://osv.dev/vulnerability/AZL-25674 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-28425 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-28425 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-keydb-2023-28425 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-valkey-2023-28425 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:2925-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-28425 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/BIT-redis-2023-28425 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-28425 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12874-1 · Vendor Advisory