Specially crafted MSETNX command can lead to denial-of-service
CVE-2023-28425

5.5MEDIUM

Key Information:

Vendor
Redis
Status
Redis
Vendor
CVE Published:
20 March 2023

Summary

Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Redis version 7.0.10.

Affected Version(s)

redis >= 7.0.8, < 7.0.10

References

https://github.com/redis/redis/security/advisories/GHSA-m...
x_refsource_CONFIRM
https://github.com/redis/redis/commit/48e0d4788434833b478...
x_refsource_MISC
https://github.com/redis/redis/releases/tag/7.0.10
x_refsource_MISC

EPSS Score

27% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.