PT-2023-6560 · Redis+10 · Redis+10
Al2Klimov
·
Published
2023-10-18
·
Updated
2026-04-01
·
CVE-2023-45145
CVSS v3.1
3.6
Low
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Redis versions prior to 6.2.14
Redis versions prior to 7.0.14
Redis versions prior to 7.2.2
Description
Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0-RC1.
Recommendations
For versions prior to 6.2.14, upgrade to version 6.2.14 or later.
For versions prior to 7.0.14, upgrade to version 7.0.14 or later.
For versions prior to 7.2.2, upgrade to version 7.2.2 or later.
As a temporary workaround, consider disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory.
Exploit
Fix
Exposure of Resource to Wrong Sphere
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Red Hat
Red Os
Redis
Rocky Linux
Suse
Ubuntu