CVE-2023-41053
Summary
| CVE | CVE-2023-41053 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-09-06 21:15:00 UTC |
| Updated | 2023-09-16 04:15:00 UTC |
| Description | Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by `SORT_RO` and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been fixed in Redis 7.0.13 and 7.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
Risk And Classification
Problem Types: CWE-269
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| [SECURITY] Fedora 39 Update: redis-7.2.1-1.fc39 - package-announce - Fedora Mailing-Lists | MISC | lists.fedoraproject.org | |
| [SECURITY] Fedora 37 Update: redis-7.0.13-1.fc37 - package-announce - Fedora Mailing-Lists | MISC | lists.fedoraproject.org | |
| Fix sort_ro get-keys function return wrong key number (#12522) · redis/redis@9e505e6 · GitHub | MISC | github.com | |
| Redis SORT_RO may bypass ACL configuration · Advisory · redis/redis · GitHub | MISC | github.com | |
| [SECURITY] Fedora 38 Update: redis-7.0.13-1.fc38 - package-announce - Fedora Mailing-Lists | MISC | lists.fedoraproject.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 284519 Fedora Security Update for redis (FEDORA-2023-03422cb8de)
- 284520 Fedora Security Update for redis (FEDORA-2023-0e9e7544df)
- 285266 Fedora Security Update for redis (FEDORA-2023-5a7cc198c2)
- 505929 Alpine Linux Security Update for redis
- 6000455 Debian Security Update for redis (DSA 5610-1)
- 754895 SUSE Enterprise Linux Security Update for redis7 (SUSE-SU-2023:3711-1)