Redis 8.2.x < 8.2.9 / 8.4.x < 8.4.6 / 8.6.x < 8.6.6 / 8.8.x < 8.8.2 / 8.10.x < 8.10.1 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(350289);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/28");

  script_cve_id("CVE-2026-62356", "CVE-2026-81934");
  script_xref(name:"IAVA", value:"2026-A-1052");

  script_name(english:"Redis 8.2.x < 8.2.9 / 8.4.x < 8.4.6 / 8.6.x < 8.6.6 / 8.8.x < 8.8.2 / 8.10.x < 8.10.1 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"A database server running on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Redis installed on the remote host is 8.2.x prior to 8.2.9, 8.4.x prior to 8.4.6, 8.6.x prior to
8.6.6, 8.8.x prior to 8.8.2, or 8.10.x prior to 8.10.1. It is, therefore, affected by multiple vulnerabilities:

  - A use-after-free vulnerability in the tlsProcessPendingData() function, which handles the TLS pending-data list
    if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary
    commands with the privileges of the Redis server. (CVE-2026-81934)

  - A miscalculated buffer size in CMSketch RDB loading may lead to a heap out-of-bounds write.
    (CVE-2026-62356)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://raw.githubusercontent.com/redis/redis/8.2/00-RELEASENOTES");
  script_set_attribute(attribute:"see_also", value:"https://raw.githubusercontent.com/redis/redis/8.4/00-RELEASENOTES");
  script_set_attribute(attribute:"see_also", value:"https://raw.githubusercontent.com/redis/redis/8.6/00-RELEASENOTES");
  script_set_attribute(attribute:"see_also", value:"https://raw.githubusercontent.com/redis/redis/8.8/00-RELEASENOTES");
  script_set_attribute(attribute:"see_also", value:"https://raw.githubusercontent.com/redis/redis/8.10/00-RELEASENOTES");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Redis version 8.2.9 / 8.4.6 / 8.6.6 / 8.8.2 / 8.10.1 or later.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:H/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-81934");
  script_set_attribute(attribute:"cvss_score_rationale", value:"Score based on NVD CVSSv3 vector (AV:A/AC:H/PR:L).");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(416);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/17");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/25");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:redis:redis");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("redis_detect.nbin", "redis_ltd_redis_nix_installed.nbin");
  script_require_keys("installed_sw/Redis Server", "Settings/ParanoidReport");

  exit(0);
}

include('vdf.inc');

if (report_paranoia < 2) audit(AUDIT_PARANOID);

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'paranoia': true}}
  ],
  'checks': [
    {
      'product': {'name': 'Redis Server', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '8.2.0', 'fixed_version': '8.2.9'},
        {'min_version': '8.4.0', 'fixed_version': '8.4.6'},
        {'min_version': '8.6.0', 'fixed_version': '8.6.6'},
        {'min_version': '8.8.0', 'fixed_version': '8.8.2'},
        {'min_version': '8.10.0', 'fixed_version': '8.10.1'}
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING, check_backporting:TRUE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);