CVE-2023-28856
`HINCRBYFLOAT` can be used to crash a redis-server process
概要
HINCRBYFLOAT can be used to crash a redis-server process
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Redis is an open source, in-memory database that persists on disk. Authenticated users can use the HINCRBYFLOAT command to create an invalid hash field that will crash Redis on access in affected versions. This issue has been addressed in in versions 7.0.11, 6.2.12, and 6.0.19. Users are advised to upgrade. There are no known workarounds for this issue.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Bitnami
keydb
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.0.19"},{"introduced":"6.2.0"},{"fixed":"6.2.12"},{"introduced":"7.0.0"},{"fixed":"7.0.11"}]}]
Bitnami
redis
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.0.19"},{"introduced":"6.2.0"},{"fixed":"6.2.12"},{"introduced":"7.0.0"},{"fixed":"7.0.11"}]}]
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2023-28856 redis 修正版: 5:6.0.16-1+deb11u3
参照URL
- advisory github.com
- advisory security.netapp.com
- advisory nvd.nist.gov
- advisory github.com
- patch github.com
- patch github.com
- web lists.debian.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org