CVE-2023-25155

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-25155
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-25155.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-25155
Aliases
Downstream
Related
Published
2023-03-02T03:01:36.879Z
Modified
2026-03-03T02:52:05.060200Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Integer Overflow in several Redis commands can lead to denial of service.
Details

Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. This problem affects all Redis versions. Patches were released in Redis version(s) 6.0.18, 6.2.11 and 7.0.9.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25155.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-190"
    ]
}
References

Affected packages

Git / github.com/redis/redis

Affected ranges

Type
GIT
Repo
https://github.com/redis/redis
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ebe2e4583fc6b4cd1a8142caa51fa7c8d37d6de3
Introduced
445aa844b946a8f1bc21ac8554b44adb1ecb4018
Fixed
720ea82eab846abc36651d01cc9f8347d4f42f90
Introduced
d375595d5e3ae2e5c29e6c00a2dc3d60578fd9fc
Fixed
86920532f72ff005fcb146c5a02562f9a10b8140

Affected versions

6.*
6.2.0
6.2.1
6.2.10
6.2.2
6.2.3
6.2.4
6.2.5
6.2.6
6.2.7
6.2.8
6.2.9
7.*
7.0.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-25155.json"