PT-2023-7359 · Redis+7 · Redis+7

Yype · Published 2023-01-16 · Updated 2025-10-21 · CVE-2023-22458

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Redis versions 6.2 through 6.2.8 Redis versions 7.0 through 7.0.7

Description The issue is related to an integer overflow in the Redis database management system. Authenticated users can trigger a denial-of-service by crashing Redis with an assertion failure using specially crafted arguments with the HRANDFIELD or ZRANDMEMBER command.

Recommendations For Redis versions 6.2 through 6.2.8, upgrade to version 6.2.9 or newer. For Redis versions 7.0 through 7.0.7, upgrade to version 7.0.8 or newer. As a temporary workaround, consider restricting access to the HRANDFIELD and ZRANDMEMBER commands until a patch is applied.

Exploit

Fix

DoS

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALSA-2025:0595

ALT-PU-2023-4982

ALT-PU-2023-5229

ALT-PU-2023-5230

ALT-PU-2023-5487

ALT-PU-2025-11673

ALT-PU-2025-13204

AZL-13053

BDU:2023-08390

BIT-KEYDB-2023-22458

BIT-REDIS-2023-22458

BIT-VALKEY-2023-22458

CESA-2025_0595

CVE-2023-22458

GHSA-R8W2-2M53-GPRJ

INFSA-2025_0595

OPENSUSE-SU-2023_0295-1

OPENSUSE-SU-2024:12619-1

RHSA-2025:0595

RHSA-2025_0595

RLSA-2025:0595

ROSA-SA-2023-2174

SUSE-SU-2023:0295-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Red Hat

Redis

Rocky Linux

Suse

References · 62

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22458.json · Exploit
• https://github.com/redis/redis/commit/16f408b1a0121cacd44cbf8aee275d69dc627f02 · Patch
• https://osv.dev/vulnerability/BIT-keydb-2023-22458 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2023-22458 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2025:0595 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-valkey-2023-22458 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2025-0595.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22458 · Security Note
• https://osv.dev/vulnerability/AZL-13053 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-22458 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08390 · Security Note
• https://osv.dev/vulnerability/BIT-redis-2023-22458 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2025:0595 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12619-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-22458 · Vendor Advisory