CVE-2025-48493
Yii 2 Redis may expose AUTH paramters in logs in case of connection failure
概要
Yii 2 Redis may expose AUTH paramters in logs in case of connection failure
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
The Yii 2 Redis extension provides the redis key-value store support for the Yii framework 2.0. On failing connection, the extension writes commands sequence to logs. Prior to version 2.0.20, AUTH parameters are written in plain text exposing username and password. That might be an issue if attacker has access to logs. Version 2.0.20 fixes the issue.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com