CVE-2023-41056: Redis vulnerable to integer overflow in certain payloads
First published: Wed Jan 10 2024(Updated: )
Redis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can result in integer overflow that leads to heap overflow and potential remote code execution. This issue has been patched in version 7.0.15 and 7.2.4.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ioredis | >=7.0.9<7.0.15 | |
| ioredis | >=7.2.0<7.2.4 | |
| Red Hat Fedora | =38 | |
| Red Hat Fedora | =39 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/redis/redis/releases/tag/7.0.15
- https://github.com/redis/redis/releases/tag/7.2.4
- https://github.com/redis/redis/security/advisories/GHSA-xr47-pcmx-fq2m
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3JTGQJ2YLYB24B72I5B5H32YIMPVSWIT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JTWHPLC3RI67VNRDOIXLDVNC5YMYBMQN/
- https://security.netapp.com/advisory/ntap-20240223-0003/
Frequently Asked Questions
What is the severity of CVE-2023-41056?
CVE-2023-41056 is considered a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2023-41056?
To fix CVE-2023-41056, upgrade Redis to version 7.0.15 or 7.2.4 or later.
Which versions of Redis are affected by CVE-2023-41056?
CVE-2023-41056 affects Redis versions prior to 7.0.15 and between 7.2.0 and 7.2.4.
What can happen if CVE-2023-41056 is exploited?
Exploitation of CVE-2023-41056 can lead to heap overflow and potentially allow an attacker to execute arbitrary code on the server.
Is there a known fix for CVE-2023-41056?
Yes, the known fix for CVE-2023-41056 is to update to Redis version 7.0.15 or 7.2.4.
- agent/type
- agent/weakness
- agent/author
- agent/description
- agent/title
- agent/first-publish-date
- agent/event
- agent/severity
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/redis
- canonical/ioredis
- version/ioredis/7.0.9
- version/ioredis/7.2.0
- vendor/fedoraproject
- canonical/red hat fedora
- version/red hat fedora/38
- version/red hat fedora/39