Remote Code Execution (RCE)

🗓️ 06 Aug 2023 17:09:29Reported by Veracode Vulnerability DatabaseType

veracode

veracode🔗 sca.analysiscenter.veracode.com👁 42 Views

Vulnerability in Redis for Remote Code Execution due to cJSON and cmsgpack flaw

Reporter	Title	Published	Views	Family All 169
FreeBSD	redis -- Heap overflow in the cjson and cmsgpack libraries	10 Jul 202300:00	–	freebsd
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift	15 Apr 202502:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Assistant App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	29 Jan 202520:13	–	ibm
GithubExploit	Exploit for Heap-based Buffer Overflow in Redis	28 Jul 202317:42	–	githubexploit
Tenable Nessus	Amazon Linux 2023 : redis6, redis6-devel (ALAS2023-2023-291)	14 Aug 202300:00	–	nessus
Tenable Nessus	Amazon Linux 2 : redis (ALASREDIS6-2023-002)	27 Sep 202300:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0014: redis:6 (ALINUX3-SA-2025:0014)	14 May 202500:00	–	nessus
Tenable Nessus	AlmaLinux 8 : redis:6 (ALSA-2025:0595)	23 Jan 202500:00	–	nessus
Tenable Nessus	AlmaLinux 9 : redis (ALSA-2025:0693)	29 Jan 202500:00	–	nessus
Tenable Nessus	Debian dla-3885 : redis - security update	10 Sep 202400:00	–	nessus

Vulners

Node

redis redisMatch5:6.0.15-1debian

AND

redis redisMatch5:6.0.9-1debian

AND

debian debian_linuxMatch999

OR

redis redisMatch7.0.7-r0os

AND

redis redisMatch7.0.3-r0os

AND

redis redisMatch7.0.4-r0os

AND

redis redisMatch6.2.1-r0os

AND

redis redisMatch7.0.11-r0os

AND

redis redisMatch7.0.9-r0os

AND

redis redisMatch5.0.8-r0os

AND

redis redisMatch6.2.7-r0os

AND

redis redisMatch6.0.1-r0os

AND

redis redisMatch7.0.8-r0os

AND

redis redisMatch6.2.6-r0os

AND

redis redisMatch7.0.4-r2os

AND

redis redisMatch7.0.0-r0os

AND

redis redisMatch5.0.9-r0os

AND

redis redisMatch7.0.2-r0os

AND

redis redisMatch7.0.5-r0os

AND

redis redisMatch7.0.10-r1os

AND

redis redisMatch6.2.5-r0os

AND

redis redisMatch6.2.3-r0os

AND

redis redisMatch6.2.4-r0os

AND

redis redisMatch7.0.4-r1os

AND

redis redisMatch5.0.7-r0os

AND

redis redisMatch7.0.10-r0os

AND

alpinelinux alpine_linuxMatchedge

OR

redis redisMatch7.0.11-r0os

AND

alpinelinux alpine_linuxMatch3.18

OR

redis redisMatch7.0.4-r1os

AND

redis redisMatch6.2.7-r0os

AND

redis redisMatch6.2.6-r0os

AND

redis redisMatch7.0.5-r0os

AND

redis redisMatch7.0.9-r0os

AND

redis redisMatch7.0.4-r0os

AND

redis redisMatch7.0.11-r0os

AND

redis redisMatch7.0.0-r0os

AND

redis redisMatch7.0.2-r0os

AND

redis redisMatch7.0.10-r0os

AND

redis redisMatch7.0.8-r0os

AND

alpinelinux alpine_linuxMatch3.16

OR

redis redisMatch7.0.11-r0os

AND

redis redisMatch7.0.9-r0os

AND

redis redisMatch7.0.5-r0os

AND

redis redisMatch7.0.8-r0os

AND

redis redisMatch7.0.10-r0os

AND

redis redisMatch7.0.7-r0os

AND

alpinelinux alpine_linuxMatch3.17

OR

redis redisMatch5:6.0.9-1debian

AND

redis redisMatch5:6.0.15-1debian

AND

debian debian_linuxMatch11

Source	Link
security-tracker	www.security-tracker.debian.org/tracker/CVE-2022-24834
github	www.github.com/redis/redis/security/advisories/GHSA-p8x2-9v9q-c838
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/MIF5MAGYARYUMRFK7PQI7HYXMK2HZE5T/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/TDNNH2ONMVNBQ6LUIAOAGDNFPKXNST5K/
security	www.security.netapp.com/advisory/ntap-20230814-0006/

14 Aug 2023 20:42Current

7.8High risk

Vulners AI Score7.8

CVSS 3.17 - 8.8

EPSS0.45527

SSVC

remote code execution vulnerability redis cjson cmsgpack