CVE-2023-41056

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-41056

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

R

edis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can result in integer overflow that leads to heap overflow and potential remote code execution. This issue has been patched in version 7.0.15 and 7.2.4.

References
Link Resource
https://github.com/redis/redis/releases/tag/7.0.15 Release Notes
https://github.com/redis/redis/releases/tag/7.2.4 Release Notes
https://github.com/redis/redis/security/advisories/GHSA-xr47-pcmx-fq2m Vendor Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/3JTGQJ2YLYB24B72I5B5H32YIMPVSWIT/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/JTWHPLC3RI67VNRDOIXLDVNC5YMYBMQN/ Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20240223-0003/
https://github.com/redis/redis/releases/tag/7.0.15 Release Notes
https://github.com/redis/redis/releases/tag/7.2.4 Release Notes
https://github.com/redis/redis/security/advisories/GHSA-xr47-pcmx-fq2m Vendor Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/3JTGQJ2YLYB24B72I5B5H32YIMPVSWIT/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/JTWHPLC3RI67VNRDOIXLDVNC5YMYBMQN/ Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20240223-0003/
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*
cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
History

21 Nov 2024, 08:20

Type Values Removed Values Added
References () https://github.com/redis/redis/releases/tag/7.0.15 - Release Notes () https://github.com/redis/redis/releases/tag/7.0.15 - Release Notes
References () https://github.com/redis/redis/releases/tag/7.2.4 - Release Notes () https://github.com/redis/redis/releases/tag/7.2.4 - Release Notes
References () https://github.com/redis/redis/security/advisories/GHSA-xr47-pcmx-fq2m - Vendor Advisory () https://github.com/redis/redis/security/advisories/GHSA-xr47-pcmx-fq2m - Vendor Advisory
References () https://lists.fedoraproject.org/archives/list/[email protected]/message/3JTGQJ2YLYB24B72I5B5H32YIMPVSWIT/ - Mailing List, Third Party Advisory () https://lists.fedoraproject.org/archives/list/[email protected]/message/3JTGQJ2YLYB24B72I5B5H32YIMPVSWIT/ - Mailing List, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/[email protected]/message/JTWHPLC3RI67VNRDOIXLDVNC5YMYBMQN/ - Mailing List, Third Party Advisory () https://lists.fedoraproject.org/archives/list/[email protected]/message/JTWHPLC3RI67VNRDOIXLDVNC5YMYBMQN/ - Mailing List, Third Party Advisory
References () https://security.netapp.com/advisory/ntap-20240223-0003/ - () https://security.netapp.com/advisory/ntap-20240223-0003/ -
Information

Published : 2024-01-10 16:15

Updated : 2024-11-21 08:20

NVD link : CVE-2023-41056

Mitre link : CVE-2023-41056

CVE.ORG link : CVE-2023-41056

JSON object : View

Products Affected

fedoraproject

redis

CWE
CWE-190

Integer Overflow or Wraparound

CWE-762

Mismatched Memory Management Routines