CVE-2023-25155
Fixed in a distro release EPSS <1%CVSS 5.5
Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. This problem affects all Redis versions. Patches were released in Redis version(s) 6.0.18, 6.2.11 and 7.0.9.
Products: Redis
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | redis | 6.2.17-1.module_el8.10.0+3946+3de613d5 |
| AlmaLinux 8 | redis-devel | 6.2.17-1.module_el8.10.0+3946+3de613d5 |
| AlmaLinux 8 | redis-doc | 6.2.17-1.module_el8.10.0+3946+3de613d5 |
| Chainguard | redis-6.2.10-benchmark | 6.2.10-r40 |
| Chainguard | redis-6.2.10-cli | 6.2.10-r40 |
| Debian 11 | redis | 5:6.0.16-1+deb11u3 |
| Debian 12 | redis | 5:7.0.9-1 |
| Debian 13 | redis | 5:7.0.9-1 |
| Debian 14 | redis | 5:7.0.9-1 |
| Red Hat Enterprise Linux 8 | redis | 0:6.2.17-1.module+el8.10.0+22680+748527fd |
| Red Hat Enterprise Linux 8 | redis-debuginfo | 0:6.2.17-1.module+el8.10.0+22680+748527fd |
| Red Hat Enterprise Linux 8 | redis-debugsource | 0:6.2.17-1.module+el8.10.0+22680+748527fd |
| Red Hat Enterprise Linux 8 | redis-devel | 0:6.2.17-1.module+el8.10.0+22680+748527fd |
| Red Hat Enterprise Linux 8 | redis-doc | 0:6.2.17-1.module+el8.10.0+22680+748527fd |
| Rocky Linux 8 | redis | 0:6.2.17-1.module+el8.10.0+1923+5b85c6a7 |
| SUSE Enterprise Storage 7 | redis | 6.0.14-150200.6.20.1 |
| SUSE Enterprise Storage 7.1 | redis | 6.0.14-150200.6.20.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | redis | 6.0.14-150200.6.20.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS | redis | 6.0.14-150200.6.20.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | redis | 6.0.14-150200.6.20.1 |
| SUSE Linux Enterprise Module for Server Applications 15 SP4 | redis | 6.2.6-150400.3.16.1 |
| SUSE Linux Enterprise Module for Server Applications 15 SP4 | redis | 6.2.6-150400.3.19.1 |
| SUSE Linux Enterprise Module for Server Applications 15 SP5 | redis7 | 7.0.8-150500.3.3.1 |
| SUSE Linux Enterprise Real Time 15 SP3 | redis | 6.0.14-150200.6.20.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | redis | 6.0.14-150200.6.20.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | redis | 6.0.14-150200.6.20.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | redis | 6.0.14-150200.6.20.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | redis | 6.0.14-150200.6.20.1 |
| SUSE Manager Proxy 4.2 | redis | 6.0.14-150200.6.20.1 |
| SUSE Manager Server 4.2 | redis | 6.0.14-150200.6.20.1 |
| Ubuntu Pro 14.04 LTS | redis | 2:2.8.4-2ubuntu0.2+esm3 |
| Ubuntu Pro 16.04 LTS | redis | 2:3.0.6-1ubuntu0.4+esm2 |
| Ubuntu Pro 18.04 LTS | redis | 5:4.0.9-1ubuntu0.2+esm4 |
| Ubuntu Pro 20.04 LTS | redis | 5:5.0.7-2ubuntu0.1+esm2 |
| Ubuntu Pro 22.04 LTS | redis | 5:6.0.16-1ubuntu1+esm1 |
| openSUSE Leap 15.4 | redis | 6.2.6-150400.3.19.1 |
| openSUSE Leap 15.4 | redis | 6.2.6-150400.3.16.1 |
| openSUSE Leap 15.5 | redis7 | 7.0.8-150500.3.3.1 |
| openSUSE Tumbleweed | redis | 7.0.8-2.1 |