Redis is an open source, in-memory database that persists on disk. Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access in affected versions. This issue has been addressed in in versions 7.0.11, 6.2.12, and 6.0.19. Users are advised to upgrade. There are no known workarounds for this issue.
References
| Link | Resource |
|---|---|
| https://github.com/redis/redis/commit/bc7fe41e5857a0854d524e2a63a028e9394d2a5c | Patch |
| https://github.com/redis/redis/pull/11149 | Issue Tracking Patch |
| https://github.com/redis/redis/security/advisories/GHSA-hjv8-vjf6-wcr6 | Vendor Advisory |
| https://lists.debian.org/debian-lts-announce/2023/04/msg00023.html | Mailing List Third Party Advisory |
| https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EQ4DJSO4DMR55AWK6OPVJH5UTEB35R2Z/ | Mailing List Third Party Advisory |
| https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LPUTH7NBQTZDVJWFNUD24ZCS6NDUFYS6/ | Mailing List Third Party Advisory |
| https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OQGKMKSQE67L32HE6W5EI2I2YKW5VWHI/ | Mailing List Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20230601-0007/ |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
01 Jun 2023, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| CWE |
28 Apr 2023, 01:05
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| References | (MISC) https://lists.debian.org/debian-lts-announce/2023/04/msg00023.html - Mailing List, Third Party Advisory | |
| References | (MISC) https://github.com/redis/redis/commit/bc7fe41e5857a0854d524e2a63a028e9394d2a5c - Patch | |
| References | (MISC) https://github.com/redis/redis/pull/11149 - Issue Tracking, Patch | |
| References | (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EQ4DJSO4DMR55AWK6OPVJH5UTEB35R2Z/ - Mailing List, Third Party Advisory | |
| References | (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OQGKMKSQE67L32HE6W5EI2I2YKW5VWHI/ - Mailing List, Third Party Advisory | |
| References | (MISC) https://github.com/redis/redis/security/advisories/GHSA-hjv8-vjf6-wcr6 - Vendor Advisory | |
| References | (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LPUTH7NBQTZDVJWFNUD24ZCS6NDUFYS6/ - Mailing List, Third Party Advisory | |
| CPE | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* |
27 Apr 2023, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
21 Apr 2023, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-04-18 21:15
Updated : 2024-02-04 23:37
NVD link : CVE-2023-28856
Mitre link : CVE-2023-28856
CVE.ORG link : CVE-2023-28856
JSON object : View
Products Affected
debian
- debian_linux
fedoraproject
- fedora
redis
- redis