Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2016-10517 →

DEBIAN-CVE-2016-10517

networking.c in Redis before 3.2.7 allows "Cross Protocol Scripting" because it lacks a check for POST and Host: strings, which are not valid in the R...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

networking.c in Redis before 3.2.7 allows "Cross Protocol Scripting" because it lacks a check for POST and Host: strings, which are not valid in the Redis protocol (but commonly occur when an attack triggers an HTTP request to the Redis TCP port).

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 redis

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:3.2.7-1"}]}]

Debian:13 redis

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:3.2.7-1"}]}]

Debian:14 redis

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:3.2.7-1"}]}]

Références

advisory security-tracker.debian.org