Integer overflow in multiple Redis commands can lead to denial-of-service
Summary
Integer overflow in multiple Redis commands can lead to denial-of-service
Original description
The description as published by the source.
Redis is an in-memory database that persists on disk. Authenticated users can issue a HRANDFIELD or ZRANDMEMBER command with specially crafted arguments to trigger a denial-of-service by crashing Redis with an assertion failure. This problem affects Redis versions 6.2 or newer up to but not including 6.2.9 as well as versions 7.0 up to but not including 7.0.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2023-22458 redis Fixed in: 5:7.0.8-1
References
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- patch github.com
- web github.com
- web github.com