Integer overflow in multiple Redis commands can lead to denial-of-service
概要
Integer overflow in multiple Redis commands can lead to denial-of-service
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Redis is an in-memory database that persists on disk. Authenticated users can issue a HRANDFIELD or ZRANDMEMBER command with specially crafted arguments to trigger a denial-of-service by crashing Redis with an assertion failure. This problem affects Redis versions 6.2 or newer up to but not including 6.2.9 as well as versions 7.0 up to but not including 7.0.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2023-22458 redis 修正版: 5:7.0.8-1
参照URL
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- patch github.com
- web github.com
- web github.com