CVE-2023-28856

Katalog CVE

CVSS 6.5 · Medium EPSS 1,3%

Kerentanan Improper Input Validation pada redis, debian linux +1 lainnya. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Redis is an open source, in-memory database that persists on disk. Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access in affected versions. This issue has been addressed in in versions 7.0.11, 6.2.12, and 6.0.19. Users are advised to upgrade. There are no known workarounds for this issue.

Rincian

Terbit di NVD

18 April 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-617: Reachable Assertion

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 68,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/redis/redis/security/advisories/GHSA-hjv8-vjf6-wcr6 advisory vendor
• https://github.com/redis/redis/commit/bc7fe41e5857a0854d524e2a63a028e9394d2a5c patch
• https://github.com/redis/redis/pull/11149 issue tracking · patch
• https://lists.debian.org/debian-lts-announce/2023/04/msg00023.html mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EQ4DJSO4DMR55AW... mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LPUTH7NBQTZDVJW... mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OQGKMKSQE67L32H... mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20230601-0007/