CVE-2023-45145

2023-10-1800:00:00

ubuntu.com

redis

in-memory database

race condition

security vulnerability

unix socket

umask

upgrade

CVSS3

3.6

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS

Percentile

10.5%

JSON

Redis is an in-memory database that persists on disk. On startup, Redis
begins listening on a Unix socket before adjusting its permissions to the
user-provided configuration. If a permissive umask(2) is used, this creates
a race condition that enables, during a short period of time, another
process to establish an otherwise unauthorized connection. This problem has
existed since Redis 2.6.0-RC1. This issue has been addressed in Redis
versions 7.2.2, 7.0.14 and 6.2.14. Users are advised to upgrade. For users
unable to upgrade, it is possible to work around the problem by disabling
Unix sockets, starting Redis with a restrictive umask, or storing the Unix
socket file in a protected directory.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchredis< 5:4.0.9-1ubuntu0.2+esm4UNKNOWN
ubuntu20.04noarchredis< 5:5.0.7-2ubuntu0.1+esm2UNKNOWN
ubuntu22.04noarchredis< 5:6.0.16-1ubuntu1+esm1UNKNOWN
ubuntu14.04noarchredis< 2:2.8.4-2ubuntu0.2+esm3UNKNOWN
ubuntu16.04noarchredis< 2:3.0.6-1ubuntu0.4+esm2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	redis	< 5:4.0.9-1ubuntu0.2+esm4	UNKNOWN
ubuntu	20.04	noarch	redis	< 5:5.0.7-2ubuntu0.1+esm2	UNKNOWN
ubuntu	22.04	noarch	redis	< 5:6.0.16-1ubuntu1+esm1	UNKNOWN
ubuntu	14.04	noarch	redis	< 2:2.8.4-2ubuntu0.2+esm3	UNKNOWN
ubuntu	16.04	noarch	redis	< 2:3.0.6-1ubuntu0.4+esm2	UNKNOWN