redis_exploit

CVE-2025-49844 RediShell - 实验环境 一个用于测试和理解 Redis 中严重漏洞 CVE-2025-49844 RediShell 的实用实验环境。 ⚠️ 警告 本内容仅供教育用途！ 仅可在您拥有或已获得明确测试许可的系统上使用 切勿暴露到互联网 切勿在生产环境中使用 关于漏洞 CVE 编号 ：CVE-2025-49844 名称 ：RediShell CVSS 评分 ：10.0（严重） 类型 ：Lua 解释器中的释放后使用（Use-After-Free，UAF） 影响 ：远程代码执行（RCE） 发现者 ：Wiz Research Team 受影响版本...

CVE-2025-49844

This repository does not have a README...

CVE-2025-49844-RediShell-Vulnerability-Scanner

CVE-2025-49844 RediShell 漏洞扫描器 描述 用于检测 Redis 中 CVE-2025-49844 RediShell 漏洞的工具。该工具执行安全检测，不会对漏洞进行实际利用。 漏洞信息 CVE-2025-49844 - Redis Lua 解释器中的 Use-After-Free 漏洞，允许已认证的攻击者执行任意代码（RCE）。 安装 环境要求 Python 3.6+ 依赖库：redis、packaging 安装依赖 root@kitploit: pip install redis packaging...

reditrap

RediTrap 蜜罐 RediTrap 是一个极简的 Redis 蜜罐，专用于发现针对 CVE-2025-49844（“RediShell”）的早期利用尝试，这是由 Wiz Research 描述的一个严重远程代码执行漏洞。该漏洞利用的是嵌入式 Lua 引擎中一个存在了 13 年的释放后使用（use-after-free）缺陷：Redis 在存储 Lua 代码块名称时未先将其锚定在栈上，导致垃圾回收周期可以在 C 代码仍使用该指针时回收该字符串。Redis 补丁 d5728cb 通过在解析前将代码块名称推入 Lua 栈（通过...

Photon OS 5.0: Redis PHSA-2025-5.0-91-0676

An update of the redis package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0676. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CLEANSTART-2026-RB64166 Security fixes in redis 8.0.4-r0

Package redis version 8.0.4-r0 fixes 4 vulnerabilities: CVE-2025-49844, CVE-2025-46817, CVE-2025-46818, CVE-2025-46819...

openSUSE 16 : Security update of valkey (openSUSE-SU-2026:20003-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20003-1 advisory. Update to 8.0.6: - Security fixes: - CVE-2025-49844: Fixed that a Lua script may lead to remote code execution bsc1250995 - CVE-2025-46817: Fixe...

VulnCheck KEV: CVE-2025-49844

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all...

Oracle Linux 10 : valkey (ELSA-2025-21936)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-21936 advisory. - rebase to 8.0.6 for CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 CVE-2025-46819 - rebase to 8.0.4 for CVE-2025-27151 CVE-2025-48367 and...

Oracle Linux 9 : valkey (ELSA-2025-21916)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-21916 advisory. 8.0.6-2 - rebase to 8.0.6 for CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 CVE-2025-46819 Tenable has extracted the preceding description block direct...

Ubuntu: Security Advisory (USN-7893-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

valkey security update

8.0.6-2 - rebase to 8.0.6 for CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 CVE-2025-46819...

Important: Red Hat Security Advisory: valkey security update

An update for valkey is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Mageia: Security Advisory (MGASA-2025-0307)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RockyLinux 9 : redis (RLSA-2025:19237)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:19237 advisory. redis: Lua library commands may lead to integer overflow and potential RCE CVE-2025-46817 Redis: Redis: Authenticated users can execute LUA scripts as a...

redis security update

An update is available for redis. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Redis is an advanced key-value store. It is often referred to as a data-structu...

Oracle Linux 10 : valkey (ELSA-2025-19675)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-19675 advisory. - Fix for CVE-2025-49844 Orabug: 38515582 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Not...

Oracle Linux 9 : redis:7 (ELSA-2025-19345)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-19345 advisory. 7.2.11-1.0.1 - Build with 64k pages to support redis on UEK on aarch64 7.2.11-1 - rebase to 7.2.11 for CVE-2025-49844 CVE-2025-46817 CVE-2025-46818...

About Remote Code Execution – Redis “RediShell” (CVE-2025-49844) vulnerability

About Remote Code Execution - Redis "RediShell" CVE-2025-49844 vulnerability. Redis is a popular in-memory key–value database, used as a distributed cache and message broker, with optional durability. This vulnerability allows a remote authenticated attacker to execute arbitrary code via a...

Ubuntu: Security Advisory (USN-7824-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...