Every CVE Search/ Get API key

CVE-2023-41053

Redis SORT_RO may bypass ACL configuration

3.3 LowFix available

Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by SORT_RO and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been fixed in Redis 7.0.13 and 7.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.29%Up 0.2 points since Sep 7, 2023
90%50%10%1%

What each source reports

CVE List Score used 3.3

Redis SORT_RO may bypass ACL configuration

Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by SORT_RO and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been fixed in Redis 7.0.13 and 7.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
CVE-2023-41053
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-269
Updated
2026-11-02
EUVDEUVD-2023-45576 3.3

Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by SORT_RO and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been fixed in Redis 7.0.13 and 7.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
EUVD-2023-45576
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-03
NVD 3.3

Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by SORT_RO and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been fixed in Redis 7.0.13 and 7.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
CVE-2023-41053
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-269
Updated
2026-11-02
OSVALPINE-CVE-2023-41053 3.3

Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by SORT_RO and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been fixed in Redis 7.0.13 and 7.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
ALPINE-CVE-2023-41053
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-03
OSVBELL-CVE-2023-41053 3.3
Record
BELL-CVE-2023-41053
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSV 3.3

Redis SORT_RO may bypass ACL configuration

Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by SORT_RO and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been fixed in Redis 7.0.13 and 7.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
CVE-2023-41053
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-269
Updated
2026-11-02
Show 9 moreShow less
OSVDEBIAN-CVE-2023-41053 3.3

Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by SORT_RO and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been fixed in Redis 7.0.13 and 7.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
DEBIAN-CVE-2023-41053
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVRHSA-2024:10869 7.0

Red Hat Security Advisory: redis:7 security update

Record
RHSA-2024:10869
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-41053 3.3

Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by SORT_RO and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been fixed in Redis 7.0.13 and 7.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
UBUNTU-CVE-2023-41053
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVALSA-2024:10869 No score

Moderate: redis:7 security update

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.

Security Fix(es):

  • redis: Redis SORT_RO may bypass ACL configuration (CVE-2023-41053)
  • redis: possible bypass of Unix socket permissions on startup (CVE-2023-45145)
  • redis: Denial-of-service due to malformed ACL selectors in Redis (CVE-2024-31227)
  • redis: Lua library commands may lead to stack overflow and RCE in Redis (CVE-2024-31449)
  • redis: Denial-of-service due to unbounded pattern matching in Redis (CVE-2024-31228)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2024:10869
Updated
2026-11-02
OSVBIT-keydb-2023-41053 No score

Redis SORT_RO may bypass ACL configuration

Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by SORT_RO and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been fixed in Redis 7.0.13 and 7.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
BIT-keydb-2023-41053
Updated
2026-11-02
OSVBIT-redis-2023-41053 No score

Redis SORT_RO may bypass ACL configuration

Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by SORT_RO and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been fixed in Redis 7.0.13 and 7.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
BIT-redis-2023-41053
Updated
2026-11-02
OSVBIT-valkey-2023-41053 No score

Redis SORT_RO may bypass ACL configuration

Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by SORT_RO and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been fixed in Redis 7.0.13 and 7.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
BIT-valkey-2023-41053
Updated
2026-11-02
OSVopenSUSE-SU-2024:13354-1 No score

redis-7.2.2-1.1 on GA media

These are all security issues fixed in the redis-7.2.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13354-1
Updated
2026-11-02
OSVSUSE-SU-2023:3711-1 No score

Security update for redis7

This update for redis7 fixes the following issues:

  • CVE-2023-41053: Fixed SORT_RO may bypass ACL configuration (bsc#1215094).
Record
SUSE-SU-2023:3711-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
redis
Alpine:v3.16
 7.0 up to 7.0.13-r0
7.0.13-r0
redis
Alpine:v3.17
 7.0 up to 7.0.13-r0
7.0.13-r0
redis
Alpine:v3.18
 7.0 up to 7.0.13-r0
7.0.13-r0
redis
Alpine:v3.19
 7.0 up to 7.2.1-r0
7.2.1-r0
redis
Alpine:v3.20
 7.0 up to 7.2.1-r0
7.2.1-r0
redis
Alpine:v3.21
 7.0 up to 7.2.1-r0
7.2.1-r0
redis
Alpine:v3.22
 7.0 up to 7.2.1-r0
7.2.1-r0
redis
Alpine:v3.23
 7.0 up to 7.2.1-r0
7.2.1-r0
redis
Alpine:v3.24
 7.0 up to 7.2.1-r0
7.2.1-r0
redis
AlmaLinux:9
From an advisory covering 5 CVEs
 before 7.2.6-1.module_el9.5.0+130+36ae7635
7.2.6-1.module_el9.5.0+130+36ae7635
Show 19 moreShow less
Affected packages
PackageAffectedFixed
redis-devel
AlmaLinux:9
From an advisory covering 5 CVEs
 before 7.2.6-1.module_el9.5.0+130+36ae7635
7.2.6-1.module_el9.5.0+130+36ae7635
redis-doc
AlmaLinux:9
From an advisory covering 5 CVEs
 before 7.2.6-1.module_el9.5.0+130+36ae7635
7.2.6-1.module_el9.5.0+130+36ae7635
redis
Alpaquita:23
 7.0.12-r0 up to 7.0.13-r0
7.0.13-r0
redis
Alpaquita:stream
 7.2.0-r0 up to 7.2.1-r0
7.2.1-r0
keydb
Bitnami
 7.0.0 up to 7.0.13, 7.2.0 up to 7.2.1
7.0.137.2.1
redis
Bitnami
 7.0.0 up to 7.0.13, 7.2.0 up to 7.2.1
7.0.137.2.1
valkey
Bitnami
 7.0.0 up to 7.0.13, 7.2.0 up to 7.2.1
7.0.137.2.1
redis
Debian:12
 before 5:7.0.15-1~deb12u1, plus listed versions
5:7.0.11-15:7.0.11-1+deb12u15:7.0.12-15:7.0.12-25:7.0.13-15:7.0.13-25:7.0.14-15:7.0.14-2
5:7.0.15-1~deb12u1
redis
Debian:13
 before 5:7.0.13-1
5:7.0.13-1
redis
Debian:14
 before 5:7.0.13-1
5:7.0.13-1
redis
Debian:12
From an advisory covering 5 CVEs
 before 5:7.0.15-1~deb12u1, plus listed versions
5:7.0.11-15:7.0.11-1+deb12u15:7.0.12-15:7.0.12-25:7.0.13-15:7.0.13-25:7.0.14-15:7.0.14-2
5:7.0.15-1~deb12u1
redis
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:7.2.6-1.module+el9.5.0+22422+63e067d8
0:7.2.6-1.module+el9.5.0+22422+63e067d8
redis-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:7.2.6-1.module+el9.5.0+22422+63e067d8
0:7.2.6-1.module+el9.5.0+22422+63e067d8
redis-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:7.2.6-1.module+el9.5.0+22422+63e067d8
0:7.2.6-1.module+el9.5.0+22422+63e067d8
redis-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:7.2.6-1.module+el9.5.0+22422+63e067d8
0:7.2.6-1.module+el9.5.0+22422+63e067d8
redis-doc
Red Hat:enterprise_linux:9::appstream
From an advisory covering 5 CVEs
 before 0:7.2.6-1.module+el9.5.0+22422+63e067d8
0:7.2.6-1.module+el9.5.0+22422+63e067d8
redis7
SUSE:Linux Enterprise Module for Server Applications 15 SP5
 before 7.0.8-150500.3.6.1
7.0.8-150500.3.6.1
redis7
openSUSE:Leap 15.5
 before 7.0.8-150500.3.6.1
7.0.8-150500.3.6.1
redis
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 7.2.2-1.1
7.2.2-1.1

History

History
RecordedChangedSources
affected, facts
affectedOSV
affected
aliases, publishedEUVD
first indexedCVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-41053 is a low vulnerability (CVSS 3.3) in Redis, published September 6, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. Fixed in redis 7.0.13-r0.

References

Show 46 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open