DebianDEBIAN:DLA-3396-1:0C6DC[SECURITY] [DLA 3396-1] redis security update
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
6.5 Medium
AI Score
Confidence
High
4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:N/I:N/A:P
0.002 Low
EPSS
Percentile
53.0%
Debian LTS Advisory DLA-3396-1 [email protected]
https://www.debian.org/lts/security/ Chris Lamb
April 21, 2023 https://wiki.debian.org/LTS
Package : redis
Version : 5:5.0.14-1+deb10u4
CVE ID : CVE-2023-28856
Debian Bug : 1034613
It was discovered that there was a potential remote denial of service
vulnerability in Redis, a popular 'NoSQL' key-value database.
Authenticated users could have used the HINCRBYFLOAT command to
create an invalid hash field that would have crashed the Redis server
on access.
For Debian 10 buster, this problem has been fixed in version
5:5.0.14-1+deb10u4.
We recommend that you upgrade your redis packages.
For the detailed security status of redis please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/redis
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Debian | 10 | all | redis-sentinel | < 5:5.0.14-1+deb10u4 | redis-sentinel_5:5.0.14-1+deb10u4_all.deb |
| Debian | 10 | all | redis-server | < 5:5.0.14-1+deb10u4 | redis-server_5:5.0.14-1+deb10u4_all.deb |
| Debian | 10 | all | redis-tools | < 5:5.0.14-1+deb10u4 | redis-tools_5:5.0.14-1+deb10u4_all.deb |
| Debian | 10 | all | redis | < 5:5.0.14-1+deb10u4 | redis_5:5.0.14-1+deb10u4_all.deb |
Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
6.5 Medium
AI Score
Confidence
High
4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:N/I:N/A:P
0.002 Low
EPSS
Percentile
53.0%