CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-28425 – Specially crafted MSETNX command can lead to denial-of-service
https://notcve.org/view.php?id=CVE-2023-28425
Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Redis version 7.0.10. • https://github.com/redis/redis/commit/48e0d4788434833b47892fe9f3d91be7687f25c9 https://github.com/redis/redis/releases/tag/7.0.10 https://github.com/redis/redis/security/advisories/GHSA-mvmm-4vq6-vw8c https://security.netapp.com/advisory/ntap-20230413-0005 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-617: Reachable Assertion •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-25155 – Integer Overflow in several Redis commands can lead to denial of service.
https://notcve.org/view.php?id=CVE-2023-25155
Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. This problem affects all Redis versions. Patches were released in Redis version(s) 6.0.18, 6.2.11 and 7.0.9. • https://github.com/redis/redis/commit/2a2a582e7cd99ba3b531336b8bd41df2b566e619 https://github.com/redis/redis/releases/tag/6.0.18 https://github.com/redis/redis/releases/tag/6.2.11 https://github.com/redis/redis/releases/tag/7.0.9 https://github.com/redis/redis/security/advisories/GHSA-x2r7-j9vw-3w83 • CWE-190: Integer Overflow or Wraparound •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-36021 – Redis string pattern matching can be abused to achieve Denial of Service
https://notcve.org/view.php?id=CVE-2022-36021
Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. The problem is fixed in Redis versions 6.0.18, 6.2.11, 7.0.9. • https://github.com/redis/redis/commit/dcbfcb916ca1a269b3feef86ee86835294758f84 https://github.com/redis/redis/security/advisories/GHSA-jr7j-rfj5-8xqv • CWE-407: Inefficient Algorithmic Complexity •