CVE-2023-41056

2024-01-1016:15:46

Google

osv.dev

redis

memory buffer

vulnerability

patch

version 7.0.15

version 7.2.4

remote code execution

heap overflow

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

8.2 High

AI Score

Confidence

High

0.007 Low

EPSS

Percentile

81.1%

JSON

Redis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can result in integer overflow that leads to heap overflow and potential remote code execution. This issue has been patched in version 7.0.15 and 7.2.4.

CPENameOperatorVersion
rediseq4.0.9-r1
rediseq7.0.4-r0
rediseq3.0.2-r0
rediseq2.8.11-r0
rediseq2.8.9-r0
rediseq3.0.5-r0
rediseq6.0.1-r0
rediseq6.0.5-r0
rediseq3.0.0-r0
rediseq4.0.5-r0

Name	Operator	Version
redis	eq	4.0.9-r1
redis	eq	7.0.4-r0
redis	eq	3.0.2-r0
redis	eq	2.8.11-r0
redis	eq	2.8.9-r0
redis	eq	3.0.5-r0
redis	eq	6.0.1-r0
redis	eq	6.0.5-r0
redis	eq	3.0.0-r0
redis	eq	4.0.5-r0