Lucene search

PRIOn knowledge basePRION:CVE-2023-41056

HistoryJan 10, 2024 - 4:15 p.m.

Integer overflow

2024-01-1016:15:00

PRIOn knowledge base

www.prio-n.com

redis

database

memory

buffer

heap overflow

code execution

patch

version 7.0.15

version 7.2.4

8 High

AI Score

Confidence

Low

0.007 Low

EPSS

Percentile

81.1%

JSON

Redis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can result in integer overflow that leads to heap overflow and potential remote code execution. This issue has been patched in version 7.0.15 and 7.2.4.

CPENameOperatorVersion
fedoraeq38
fedoraeq39
redisge7.2.0
redislt7.2.4
redisge7.0.9
redislt7.0.15

Name	Operator	Version
fedora	eq	38
fedora	eq	39
redis	ge	7.2.0
redis	lt	7.2.4
redis	ge	7.0.9
redis	lt	7.0.15

References

github.com/redis/redis/releases/tag/7.0.15

github.com/redis/redis/releases/tag/7.2.4

github.com/redis/redis/security/advisories/GHSA-xr47-pcmx-fq2m

lists.fedoraproject.org/archives/list/[email protected]/message/3JTGQJ2YLYB24B72I5B5H32YIMPVSWIT/

lists.fedoraproject.org/archives/list/[email protected]/message/JTWHPLC3RI67VNRDOIXLDVNC5YMYBMQN/

security.netapp.com/advisory/ntap-20240223-0003/