CVE-2016-10639: Critical severity redis vulnerability
redis-srvr is a npm wrapper for redis-server. redis-srvr downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10639?
CVE-2016-10639 has a high severity rating due to the potential for remote code execution via a man-in-the-middle attack.
How do I fix CVE-2016-10639?
To fix CVE-2016-10639, ensure that redis-srvr is updated to a version that downloads binaries from secure sources or use an alternative method to install Redis.
What causes the vulnerability in CVE-2016-10639?
CVE-2016-10639 is caused by redis-srvr downloading binary resources over HTTP, which can be intercepted by attackers.
Who is affected by CVE-2016-10639?
Users of redis-srvr who rely on insecure HTTP for downloading redis-server binaries are affected by CVE-2016-10639.
Can CVE-2016-10639 lead to data breaches?
Yes, CVE-2016-10639 can potentially lead to data breaches due to the risk of remote code execution if an attacker successfully exploits the vulnerability.