{"id":"CVE-2023-45145","aliases":["ALPINE-CVE-2023-45145","ALSA-2024:10869","ALSA-2025:0595","ALSA-2025:0693","AZL-31653","BELL-CVE-2023-45145","BIT-keydb-2023-45145","BIT-redis-2023-45145","BIT-valkey-2023-45145","DEBIAN-CVE-2023-45145","DLA-3627-1","DLA-3885-1","DSA-5610-1","EUVD-2023-49453","GHSA-ghmp-889m-7cvx","MGASA-2023-0301","OESA-2024-2230","OESA-2024-2269","OESA-2024-2270","OESA-2024-2271","OESA-2024-2272","RHSA-2024:10869","RHSA-2025:0595","RHSA-2025:0693","RLSA-2025:0595","RLSA-2025:0693","SUSE-SU-2023:4290-1","SUSE-SU-2023:4376-1","SUSE-SU-2024:0200-1","UBUNTU-CVE-2023-45145","USN-6531-1","openSUSE-SU-2024:13354-1"],"status":"published","title":"Redis Unix-domain socket may have be exposed with the wrong permissions for a short time window.","description":"Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0-RC1. This issue has been addressed in Redis versions 7.2.2, 7.0.14 and 6.2.14. Users are advised to upgrade. For users unable to upgrade, it is possible to work around the problem by disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory.","severity":{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00438,"percentile":0.38312,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-668"],"published":"2023-10-18T20:17:08Z","modified":"2026-11-03T06:32:59Z","fixes":[{"ecosystem":"Alpine:v3.15","package":"redis","fixed_in":["6.2.14-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"redis","fixed_in":["7.0.14-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"redis","fixed_in":["7.0.14-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"redis","fixed_in":["7.0.14-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"redis","fixed_in":["7.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"redis","fixed_in":["7.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"redis","fixed_in":["7.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"redis","fixed_in":["7.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"redis","fixed_in":["7.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"redis","fixed_in":["7.2.2-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"redis","fixed_in":["6.2.14-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"redis","fixed_in":["7.0.14-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"redis","fixed_in":["7.2.2-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"keydb","fixed_in":["6.2.14","7.0.14","7.2.2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"redis","fixed_in":["6.2.14","7.0.14","7.2.2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"valkey","fixed_in":["6.2.14","7.0.14","7.2.2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"redis","fixed_in":["5:7.0.15-1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"redis","fixed_in":["5:7.0.14-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"redis","fixed_in":["5:7.0.14-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"redis","fixed_in":["5:5.0.14-1+deb10u5"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"redis","fixed_in":["7.0.14-1.mga9"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"redis","fixed_in":["6.2.6-150400.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"redis","fixed_in":["6.2.6-150400.3.25.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"redis","fixed_in":["6.2.6-150400.3.25.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"redis","fixed_in":["6.2.6-150400.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"redis","fixed_in":["6.0.14-150200.6.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"redis","fixed_in":["6.0.14-150200.6.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"redis","fixed_in":["6.0.14-150200.6.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"redis","fixed_in":["6.0.14-150200.6.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"redis","fixed_in":["6.0.14-150200.6.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"redis","fixed_in":["6.0.14-150200.6.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"redis","fixed_in":["6.0.14-150200.6.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.2","package":"redis","fixed_in":["6.0.14-150200.6.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.2","package":"redis","fixed_in":["6.0.14-150200.6.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"redis","fixed_in":["6.0.14-150200.6.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"redis7","fixed_in":["7.0.8-150500.3.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"redis7","fixed_in":["7.0.8-150500.3.9.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"redis","fixed_in":["2:2.8.4-2ubuntu0.2+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"redis","fixed_in":["2:3.0.6-1ubuntu0.4+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"redis","fixed_in":["5:4.0.9-1ubuntu0.2+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"redis","fixed_in":["5:5.0.7-2ubuntu0.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"redis","fixed_in":["5:6.0.16-1ubuntu1+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.15","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"6.2.14-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"7.0.14-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"7.0.14-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"7.0.14-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"7.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"7.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"7.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"7.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"7.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"7.2.2-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.6-1.module_el9.5.0+130+36ae7635"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.6-1.module_el9.5.0+130+36ae7635"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.6-1.module_el9.5.0+130+36ae7635"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.17-1.module_el8.10.0+3946+3de613d5"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.17-1.module_el8.10.0+3946+3de613d5"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.17-1.module_el8.10.0+3946+3de613d5"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:9","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.17-1.el9_5"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.17-1.el9_5"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.17-1.el9_5"}]}],"bundled":5},{"source":"osv","ecosystem":"Azure Linux:2","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.14-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.9-r0"},{"fixed":"7.0.14-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.9-r0"},{"fixed":"7.2.2-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"keydb","ranges":[{"type":"SEMVER","events":[{"introduced":"2.6.0"},{"fixed":"6.2.14"},{"introduced":"7.0.0"},{"fixed":"7.0.14"},{"introduced":"7.2.0"},{"fixed":"7.2.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"redis","ranges":[{"type":"SEMVER","events":[{"introduced":"2.6.0"},{"fixed":"6.2.14"},{"introduced":"7.0.0"},{"fixed":"7.0.14"},{"introduced":"7.2.0"},{"fixed":"7.2.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"valkey","ranges":[{"type":"SEMVER","events":[{"introduced":"2.6.0"},{"fixed":"6.2.14"},{"introduced":"7.0.0"},{"fixed":"7.0.14"},{"introduced":"7.2.0"},{"fixed":"7.2.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:7.0.15-1~deb12u1"}]}],"versions":["5:7.0.11-1","5:7.0.11-1+deb12u1","5:7.0.12-1","5:7.0.12-2","5:7.0.13-1","5:7.0.13-2","5:7.0.14-1","5:7.0.14-2"]},{"source":"osv","ecosystem":"Debian:13","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:7.0.14-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:7.0.14-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.0.14-1+deb10u5"}]}],"versions":["5:5.0.14-1+deb10u1","5:5.0.14-1+deb10u2","5:5.0.14-1+deb10u3","5:5.0.14-1+deb10u4","5:5.0.3-4","5:5.0.3-4+deb10u1","5:5.0.3-4+deb10u2","5:5.0.3-4+deb10u3","5:5.0.4-1","5:5.0.5-1","5:5.0.5-2","5:5.0.5-2~bpo10+1","5:5.0.6-1","5:5.0.6-1~bpo10+1","5:5.0.7-1","5:5.0.7-1~bpo10+1","5:5.0.7-2","5:5.0.7-3","5:5.0.7-4","5:5.0.7-5","5:5.0.7-6","5:5.0.7-7","5:5.0.7-7~bpo10+1"]},{"source":"osv","ecosystem":"Debian:11","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:6.0.16-1+deb11u3"}]}],"versions":["5:6.0.15-1","5:6.0.16-1","5:6.0.16-1+deb11u1","5:6.0.16-1+deb11u2","5:6.0.16-1~bpo10+1","5:6.0.16-1~bpo11+1"],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:7.0.15-1~deb12u1"}]}],"versions":["5:7.0.11-1","5:7.0.11-1+deb12u1","5:7.0.12-1","5:7.0.12-2","5:7.0.13-1","5:7.0.13-2","5:7.0.14-1","5:7.0.14-2"],"bundled":5},{"source":"osv","ecosystem":"Mageia:9","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.14-1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.11-20.oe2003sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.14-7.oe2203sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.14-7.oe2403"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.14-7.oe2203sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.14-7.oe2203sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.6-1.module+el9.5.0+22422+63e067d8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.6-1.module+el9.5.0+22422+63e067d8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.6-1.module+el9.5.0+22422+63e067d8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.6-1.module+el9.5.0+22422+63e067d8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.6-1.module+el9.5.0+22422+63e067d8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.17-1.module+el8.10.0+22680+748527fd"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"redis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.17-1.module+el8.10.0+22680+748527fd"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"redis-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.17-1.module+el8.10.0+22680+748527fd"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.17-1.module+el8.10.0+22680+748527fd"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.17-1.module+el8.10.0+22680+748527fd"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.17-1.el9_5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.17-1.el9_5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.17-1.el9_5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.17-1.el9_5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.17-1.el9_5"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.17-1.module+el8.10.0+1923+5b85c6a7"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.17-1.el9_5"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.6-150400.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.6-150400.3.25.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.6-150400.3.25.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.6-150400.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.14-150200.6.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.14-150200.6.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.14-150200.6.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.14-150200.6.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.14-150200.6.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.14-150200.6.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.14-150200.6.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.14-150200.6.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.14-150200.6.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.14-150200.6.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"redis7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8-150500.3.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"redis7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8-150500.3.9.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.8.4-2ubuntu0.2+esm3"}]}],"versions":["2:2.6.13-1","2:2.6.16-3","2:2.8.0-1","2:2.8.2-1","2:2.8.4-2","2:2.8.4-2ubuntu0.2","2:2.8.4-2ubuntu0.2+esm1","2:2.8.4-2ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.0.6-1ubuntu0.4+esm2"}]}],"versions":["2:3.0.3-3","2:3.0.5-1","2:3.0.5-2","2:3.0.5-3","2:3.0.5-4","2:3.0.6-1","2:3.0.6-1ubuntu0.2","2:3.0.6-1ubuntu0.3","2:3.0.6-1ubuntu0.4","2:3.0.6-1ubuntu0.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:4.0.9-1ubuntu0.2+esm4"}]}],"versions":["4:4.0.1-7","4:4.0.2-6","4:4.0.2-9","5:4.0.5-1","5:4.0.6-1","5:4.0.6-2","5:4.0.7-1","5:4.0.8-1","5:4.0.8-2","5:4.0.9-1","5:4.0.9-1ubuntu0.1","5:4.0.9-1ubuntu0.2","5:4.0.9-1ubuntu0.2+esm2","5:4.0.9-1ubuntu0.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.0.7-2ubuntu0.1+esm2"}]}],"versions":["5:5.0.5-2build1","5:5.0.6-1","5:5.0.7-1","5:5.0.7-2","5:5.0.7-2ubuntu0.1~esm1","5:5.0.7-2ubuntu0.1","5:5.0.7-2ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:6.0.16-1ubuntu1+esm1"}]}],"versions":["5:6.0.15-1","5:6.0.16-1","5:6.0.16-1build1","5:6.0.16-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.8.4-2ubuntu0.2+esm3"}]}],"versions":["2:2.6.13-1","2:2.6.16-3","2:2.8.0-1","2:2.8.2-1","2:2.8.4-2","2:2.8.4-2ubuntu0.2","2:2.8.4-2ubuntu0.2+esm1","2:2.8.4-2ubuntu0.2+esm2"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.0.6-1ubuntu0.4+esm2"}]}],"versions":["2:3.0.3-3","2:3.0.5-1","2:3.0.5-2","2:3.0.5-3","2:3.0.5-4","2:3.0.6-1","2:3.0.6-1ubuntu0.2","2:3.0.6-1ubuntu0.3","2:3.0.6-1ubuntu0.4","2:3.0.6-1ubuntu0.4+esm1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:4.0.9-1ubuntu0.2+esm4"}]}],"versions":["4:4.0.1-7","4:4.0.2-6","4:4.0.2-9","5:4.0.5-1","5:4.0.6-1","5:4.0.6-2","5:4.0.7-1","5:4.0.8-1","5:4.0.8-2","5:4.0.9-1","5:4.0.9-1ubuntu0.1","5:4.0.9-1ubuntu0.2","5:4.0.9-1ubuntu0.2+esm2","5:4.0.9-1ubuntu0.2+esm3"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.0.7-2ubuntu0.1+esm2"}]}],"versions":["5:5.0.5-2build1","5:5.0.6-1","5:5.0.7-1","5:5.0.7-2","5:5.0.7-2ubuntu0.1~esm1","5:5.0.7-2ubuntu0.1","5:5.0.7-2ubuntu0.1+esm1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:6.0.16-1ubuntu1+esm1"}]}],"versions":["5:6.0.15-1","5:6.0.16-1","5:6.0.16-1build1","5:6.0.16-1ubuntu1"],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.2-1.1"}]}],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"redis","product":"redis"}],"references":[{"url":"https://github.com/redis/redis/security/advisories/GHSA-ghmp-889m-7cvx","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/redis/redis/commit/03345ddc7faf7af079485f2cbe5d17a1611cbce1","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00032.html","tags":["x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/464JPNBWE433ZGYXO3KN72VR3KJPWHAW/","tags":["x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BNEK2K4IE7MPKRD6H36JXZMJKYS6I5GQ/","tags":["x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DZMGTTV5XM4LA66FSIJSETNBBRRPJYOQ/","tags":["x_transferred","Mailing List","discussion","web"]},{"url":"https://security.netapp.com/advisory/ntap-20231116-0014/","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-45145","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:10869","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-41053","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45145","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-31227","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-31228","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-31449","tags":["report"]},{"url":"https://bugzilla.redhat.com/2237826","tags":["report"]},{"url":"https://bugzilla.redhat.com/2244940","tags":["report"]},{"url":"https://bugzilla.redhat.com/2317053","tags":["report"]},{"url":"https://bugzilla.redhat.com/2317056","tags":["report"]},{"url":"https://bugzilla.redhat.com/2317058","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-10869.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:0595","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24834","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-35977","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-36021","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-22458","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25155","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-28856","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-46981","tags":["report"]},{"url":"https://bugzilla.redhat.com/2163132","tags":["report"]},{"url":"https://bugzilla.redhat.com/2163133","tags":["report"]},{"url":"https://bugzilla.redhat.com/2174305","tags":["report"]},{"url":"https://bugzilla.redhat.com/2174306","tags":["report"]},{"url":"https://bugzilla.redhat.com/2187525","tags":["report"]},{"url":"https://bugzilla.redhat.com/2221662","tags":["report"]},{"url":"https://bugzilla.redhat.com/2336004","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-0595.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:0693","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-0693.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45145","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-45145","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45145.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-45145","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0301.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32406","tags":["report"]},{"url":"https://github.com/redis/redis/releases/tag/7.0.14","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2230","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31228","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31449","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2269","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2270","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2271","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2272","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2237826","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244940","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2317053","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2317056","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2317058","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-26628","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10869.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-41053","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41053","tags":["advisory"]},{"url":"https://github.com/redis/redis/commit/9e505e6cd842338424e05883521ca1fb7d0f47f6","tags":["article"]},{"url":"https://github.com/redis/redis/security/advisories/GHSA-q4jr-5p56-4xwc","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45145","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-31227","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31227","tags":["advisory"]},{"url":"https://github.com/redis/redis/commit/b351d5a3210e61cc3b22ba38a723d6da8f3c298a","tags":["article"]},{"url":"https://github.com/redis/redis/security/advisories/GHSA-38p4-26x2-vqhh","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-31228","tags":["advisory"]},{"url":"https://github.com/redis/redis/commit/9317bf64659b33166a943ec03d5d9b954e86afb0","tags":["article"]},{"url":"https://github.com/redis/redis/security/advisories/GHSA-66gq-c942-6976","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-31449","tags":["advisory"]},{"url":"https://github.com/redis/redis/commit/1f7c148be2cbacf7d50aa461c58b871e87cc5ed9","tags":["article"]},{"url":"https://github.com/redis/redis/security/advisories/GHSA-whxg-wx83-85p5","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2163132","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2163133","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2174305","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2174306","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2187525","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2221662","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2336004","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-66165","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0595.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24834","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24834","tags":["advisory"]},{"url":"https://github.com/redis/redis/security/advisories/GHSA-p8x2-9v9q-c838","tags":["article"]},{"url":"https://groups.google.com/g/redis-db/c/JDjKS0GubsQ","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-35977","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-35977","tags":["advisory"]},{"url":"https://github.com/redis/redis/security/advisories/GHSA-mrcw-fhw9-fj8j","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-36021","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36021","tags":["advisory"]},{"url":"https://github.com/redis/redis/commit/dcbfcb916ca1a269b3feef86ee86835294758f84","tags":["article"]},{"url":"https://github.com/redis/redis/security/advisories/GHSA-jr7j-rfj5-8xqv","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-22458","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22458","tags":["advisory"]},{"url":"https://github.com/redis/redis/security/advisories/GHSA-r8w2-2m53-gprj","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25155","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25155","tags":["advisory"]},{"url":"https://github.com/redis/redis/commit/2a2a582e7cd99ba3b531336b8bd41df2b566e619","tags":["article"]},{"url":"https://github.com/redis/redis/security/advisories/GHSA-x2r7-j9vw-3w83","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-28856","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28856","tags":["advisory"]},{"url":"https://github.com/redis/redis/security/advisories/GHSA-hjv8-vjf6-wcr6","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-46981","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46981","tags":["advisory"]},{"url":"https://github.com/redis/redis/releases/tag/6.2.17","tags":["article"]},{"url":"https://github.com/redis/redis/releases/tag/7.2.7","tags":["article"]},{"url":"https://github.com/redis/redis/releases/tag/7.4.2","tags":["article"]},{"url":"https://github.com/redis/redis/security/advisories/GHSA-39h2-x6c4-6w4c","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-26627","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0693.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:0595","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:0693","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234290-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1216376","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45145","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234376-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240200-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1212119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-45145","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6531-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-24834","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-35977","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-36021","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-25155","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-28856","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41053","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-45145","title":"Redis Unix-domain socket may have be exposed with the wrong permissions for a short time window.","description":"Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0-RC1. This issue has been addressed in Redis versions 7.2.2, 7.0.14 and 6.2.14. Users are advised to upgrade. For users unable to upgrade, it is possible to work around the problem by disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory.","status":"published","published":"2023-10-18T20:17:08.588Z","modified":"2025-02-13T17:13:50.793Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-668"],"updated_at":"2026-11-02T14:35:22.640346Z"}],"euvd":[{"id":"EUVD-2023-49453","description":"Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0-RC1. This issue has been addressed in Redis versions 7.2.2, 7.0.14 and 6.2.14. Users are advised to upgrade. For users unable to upgrade, it is possible to work around the problem by disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory.","status":"published","published":"2023-10-18T20:17:08Z","modified":"2025-02-13T17:13:50Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-03T00:03:48.562419Z"}],"nvd":[{"id":"CVE-2023-45145","description":"Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0-RC1. This issue has been addressed in Redis versions 7.2.2, 7.0.14 and 6.2.14. Users are advised to upgrade. For users unable to upgrade, it is possible to work around the problem by disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory.","status":"published","published":"2023-10-18T21:15:09.56Z","modified":"2026-06-17T06:28:18.79Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-668"],"updated_at":"2026-11-02T14:08:39.058878Z"}],"osv":[{"id":"ALPINE-CVE-2023-45145","description":"Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0-RC1. This issue has been addressed in Redis versions 7.2.2, 7.0.14 and 6.2.14. Users are advised to upgrade. For users unable to upgrade, it is possible to work around the problem by disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory.","status":"published","published":"2023-10-18T21:15:09.56Z","modified":"2026-11-03T06:32:59.424376884Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"AZL-31653","title":"CVE-2023-45145 affecting package redis for versions less than 6.2.14-1","description":"Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0-RC1. This issue has been addressed in Redis versions 7.2.2, 7.0.14 and 6.2.14. Users are advised to upgrade. For users unable to upgrade, it is possible to work around the problem by disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory.","status":"published","published":"2023-10-18T21:15:09Z","modified":"2026-04-21T04:26:26.714661Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"BELL-CVE-2023-45145","status":"published","published":"2023-10-19T05:56:19.543565Z","modified":"2026-01-26T09:35:31.023311Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"CVE-2023-45145","title":"Redis Unix-domain socket may have be exposed with the wrong permissions for a short time window.","description":"Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0-RC1. This issue has been addressed in Redis versions 7.2.2, 7.0.14 and 6.2.14. Users are advised to upgrade. For users unable to upgrade, it is possible to work around the problem by disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory.","status":"published","published":"2023-10-18T20:17:08.588Z","modified":"2026-10-28T10:39:06.19727777Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-668"],"updated_at":"2026-11-02T15:44:33.792101Z"},{"id":"DEBIAN-CVE-2023-45145","description":"Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0-RC1. This issue has been addressed in Redis versions 7.2.2, 7.0.14 and 6.2.14. Users are advised to upgrade. For users unable to upgrade, it is possible to work around the problem by disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory.","status":"published","published":"2023-10-18T21:15:09.56Z","modified":"2026-10-26T18:02:58.275850495Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"OESA-2024-2230","title":"redis security update","description":"Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets.\r\n\r\nSecurity Fix(es):\r\n\r\nRedis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0-RC1. This issue has been addressed in Redis versions 7.2.2, 7.0.14 and 6.2.14. Users are advised to upgrade. For users unable to upgrade, it is possible to work around the problem by disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory.(CVE-2023-45145)\r\n\r\nRedis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST` and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crash. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2024-31228)\r\n\r\nRedis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2024-31449)","status":"published","published":"2024-10-12T11:07:42Z","modified":"2026-08-18T01:17:34.300253911Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2269","title":"redis security update","description":"Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets.\r\n\r\nSecurity Fix(es):\r\n\r\nRedis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0-RC1. This issue has been addressed in Redis versions 7.2.2, 7.0.14 and 6.2.14. Users are advised to upgrade. For users unable to upgrade, it is possible to work around the problem by disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory.(CVE-2023-45145)\r\n\r\nRedis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST` and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crash. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2024-31228)\r\n\r\nRedis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2024-31449)","status":"published","published":"2024-10-18T11:07:44Z","modified":"2026-08-18T01:17:35.012331554Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2270","title":"redis security update","description":"Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets.\r\n\r\nSecurity Fix(es):\r\n\r\nRedis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0-RC1. This issue has been addressed in Redis versions 7.2.2, 7.0.14 and 6.2.14. Users are advised to upgrade. For users unable to upgrade, it is possible to work around the problem by disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory.(CVE-2023-45145)\r\n\r\nRedis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST` and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crash. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2024-31228)\r\n\r\nRedis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2024-31449)","status":"published","published":"2024-10-18T11:07:44Z","modified":"2026-08-18T01:18:37.472946936Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2271","title":"redis security update","description":"Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets.\r\n\r\nSecurity Fix(es):\r\n\r\nRedis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0-RC1. This issue has been addressed in Redis versions 7.2.2, 7.0.14 and 6.2.14. Users are advised to upgrade. For users unable to upgrade, it is possible to work around the problem by disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory.(CVE-2023-45145)\r\n\r\nRedis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST` and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crash. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2024-31228)\r\n\r\nRedis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2024-31449)","status":"published","published":"2024-10-18T11:07:44Z","modified":"2026-08-18T01:17:35.497343986Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2272","title":"redis security update","description":"Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets.\r\n\r\nSecurity Fix(es):\r\n\r\nRedis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0-RC1. This issue has been addressed in Redis versions 7.2.2, 7.0.14 and 6.2.14. Users are advised to upgrade. For users unable to upgrade, it is possible to work around the problem by disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory.(CVE-2023-45145)\r\n\r\nRedis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST` and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crash. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2024-31228)\r\n\r\nRedis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2024-31449)","status":"published","published":"2024-10-18T11:07:44Z","modified":"2026-08-18T01:17:35.290334626Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"RHSA-2024:10869","title":"Red Hat Security Advisory: redis:7 security update","status":"published","published":"2024-12-07T10:02:52Z","modified":"2026-08-07T10:12:50Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2025:0595","title":"Red Hat Security Advisory: redis:6 security update","status":"published","published":"2025-01-23T10:02:39Z","modified":"2026-10-16T10:06:02Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:0693","title":"Red Hat Security Advisory: redis security update","status":"published","published":"2025-01-28T10:10:05Z","modified":"2026-10-16T10:06:07Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RLSA-2025:0595","title":"Important: redis:6 security update","description":"Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.\n\nSecurity Fix(es):\n\n* redis: Integer overflow in the Redis HRANDFIELD and ZRANDMEMBER commands may lead to denial-of-service (CVE-2023-22458)\n\n* redis: Integer overflow in the Redis SETRANGE and SORT/SORT_RO commands may result with false OOM panic (CVE-2022-35977)\n\n* redis: Specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD commands can trigger an integer overflow (CVE-2022-36021)\n\n* redis: String matching commands (like SCAN or KEYS) with a specially crafted pattern to trigger a denial-of-service attack (CVE-2023-25155)\n\n* redis: Insufficient validation of HINCRBYFLOAT command (CVE-2023-28856)\n\n* redis: heap overflow in the lua cjson and cmsgpack libraries (CVE-2022-24834)\n\n* redis: possible bypass of Unix socket permissions on startup (CVE-2023-45145)\n\n* redis: Lua library commands may lead to stack overflow and RCE in Redis (CVE-2024-31449)\n\n* redis: Denial-of-service due to unbounded pattern matching in Redis (CVE-2024-31228)\n\n* redis: Redis' Lua library commands may lead to remote code execution (CVE-2024-46981)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-02-13T20:34:26.141542Z","modified":"2026-02-04T18:15:09.62632Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"UBUNTU-CVE-2023-45145","description":"Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0-RC1. This issue has been addressed in Redis versions 7.2.2, 7.0.14 and 6.2.14. Users are advised to upgrade. For users unable to upgrade, it is possible to work around the problem by disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory.","status":"published","published":"2023-10-18T21:15:00Z","modified":"2026-02-04T03:14:24.070539Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low"},{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"ALSA-2024:10869","title":"Moderate: redis:7 security update","description":"Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.  \n\nSecurity Fix(es):  \n\n  * redis: Redis SORT_RO may bypass ACL configuration (CVE-2023-41053)\n  * redis: possible bypass of Unix socket permissions on startup (CVE-2023-45145)\n  * redis: Denial-of-service due to malformed ACL selectors in Redis (CVE-2024-31227)\n  * redis: Lua library commands may lead to stack overflow and RCE in Redis (CVE-2024-31449)\n  * redis: Denial-of-service due to unbounded pattern matching in Redis (CVE-2024-31228)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2024-12-05T00:00:00Z","modified":"2026-10-29T11:30:52.000498318Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2025:0595","title":"Important: redis:6 security update","description":"Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.  \n\nSecurity Fix(es):  \n\n  * redis: Integer overflow in the Redis HRANDFIELD and ZRANDMEMBER commands may lead to denial-of-service (CVE-2023-22458)\n  * redis: Integer overflow in the Redis SETRANGE and SORT/SORT_RO commands may result with false OOM panic (CVE-2022-35977)\n  * redis: Specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD commands can trigger an integer overflow (CVE-2022-36021)\n  * redis: String matching commands (like SCAN or KEYS) with a specially crafted pattern to trigger a denial-of-service attack (CVE-2023-25155)\n  * redis: Insufficient validation of HINCRBYFLOAT command (CVE-2023-28856)\n  * redis: heap overflow in the lua cjson and cmsgpack libraries (CVE-2022-24834)\n  * redis: possible bypass of Unix socket permissions on startup (CVE-2023-45145)\n  * redis: Lua library commands may lead to stack overflow and RCE in Redis (CVE-2024-31449)\n  * redis: Denial-of-service due to unbounded pattern matching in Redis (CVE-2024-31228)\n  * redis: Redis' Lua library commands may lead to remote code execution (CVE-2024-46981)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-01-22T00:00:00Z","modified":"2026-10-29T11:02:22.119908794Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2025:0693","title":"Important: redis security update","description":"Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.  \n\nSecurity Fix(es):  \n\n  * redis: heap overflow in the lua cjson and cmsgpack libraries (CVE-2022-24834)\n  * redis: possible bypass of Unix socket permissions on startup (CVE-2023-45145)\n  * redis: Lua library commands may lead to stack overflow and RCE in Redis (CVE-2024-31449)\n  * redis: Denial-of-service due to unbounded pattern matching in Redis (CVE-2024-31228)\n  * redis: Redis' Lua library commands may lead to remote code execution (CVE-2024-46981)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-01-27T00:00:00Z","modified":"2026-10-29T11:32:12.41650709Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"BIT-keydb-2023-45145","title":"Redis Unix-domain socket may have be exposed with the wrong permissions for a short time window.","description":"Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0. This issue has been addressed in Redis versions 7.2.2, 7.0.14 and 6.2.14. Users are advised to upgrade. For users unable to upgrade, it is possible to work around the problem by disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory.","status":"published","published":"2024-08-22T19:22:46.458Z","modified":"2026-09-08T08:48:07.373523076Z","updated_at":"2026-11-02T15:28:32.162822Z"},{"id":"BIT-redis-2023-45145","title":"Redis Unix-domain socket may have be exposed with the wrong permissions for a short time window.","description":"Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0. This issue has been addressed in Redis versions 7.2.2, 7.0.14 and 6.2.14. Users are advised to upgrade. For users unable to upgrade, it is possible to work around the problem by disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory.","status":"published","published":"2024-03-06T11:03:25.305Z","modified":"2026-09-08T08:48:19.045186055Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"BIT-valkey-2023-45145","title":"Redis Unix-domain socket may have be exposed with the wrong permissions for a short time window.","description":"Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0-RC1. This issue has been addressed in Redis versions 7.2.2, 7.0.14 and 6.2.14. Users are advised to upgrade. For users unable to upgrade, it is possible to work around the problem by disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory.","status":"published","published":"2024-08-22T19:40:22.448Z","modified":"2025-10-15T02:42:34.93382Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"DLA-3627-1","title":"redis - security update","status":"published","published":"2023-10-23T00:00:00Z","modified":"2026-03-09T01:23:33.742133Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DLA-3885-1","title":"redis - security update","status":"published","published":"2024-09-10T00:00:00Z","modified":"2026-03-09T01:19:49.124344Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5610-1","title":"redis - security update","status":"published","published":"2024-01-29T00:00:00Z","modified":"2026-03-09T02:11:43.109577Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2023-0301","title":"Updated redis package fixes a security vulnerability","description":"Redis upstream published a fix for CVE-2023-45145.\n\nCVE-2023-45145: The wrong order of listen(2) and chmod(2) calls creates\na race condition that can be used by another process to bypass desired\nUnix socket permissions on startup.\n","status":"published","published":"2023-10-24T17:25:46Z","modified":"2026-04-16T04:44:15.809852028Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:13354-1","title":"redis-7.2.2-1.1 on GA media","description":"These are all security issues fixed in the redis-7.2.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:37:22.455184Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"RLSA-2025:0693","title":"Important: redis security update","description":"Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.\n\nSecurity Fix(es):\n\n* redis: heap overflow in the lua cjson and cmsgpack libraries (CVE-2022-24834)\n\n* redis: possible bypass of Unix socket permissions on startup (CVE-2023-45145)\n\n* redis: Lua library commands may lead to stack overflow and RCE in Redis (CVE-2024-31449)\n\n* redis: Denial-of-service due to unbounded pattern matching in Redis (CVE-2024-31228)\n\n* redis: Redis' Lua library commands may lead to remote code execution (CVE-2024-46981)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-03-17T20:16:49.937392Z","modified":"2026-02-04T13:45:09.088789Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"SUSE-SU-2023:4290-1","title":"Security update for redis","description":"This update for redis fixes the following issues:\n\n- CVE-2023-45145: Fixed a potential permission bypass due to a race\n  condition during UNIX socket creation (bsc#1216376).\n","status":"published","published":"2023-10-31T08:17:53Z","modified":"2026-02-04T04:00:49.310863Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4376-1","title":"Security update for redis","description":"This update for redis fixes the following issues:\n\n- CVE-2023-45145: Fixed a potential permission bypass due to a race\n  condition during UNIX socket creation (bsc#1216376).\n","status":"published","published":"2023-11-06T12:52:09Z","modified":"2026-02-04T03:38:25.640784Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2024:0200-1","title":"Security update for redis7","description":"This update for redis7 fixes the following issues:\n\n- CVE-2023-45145: Fixed a potential permission bypass due to a race\n  condition during UNIX socket creation (bsc#1216376).\n\nThe following non-security issues were fixed:\n\n- Redis services are no longer disabled after an upgrade (bsc#1212119).\n","status":"published","published":"2024-01-23T17:12:34Z","modified":"2026-02-04T02:54:01.344149Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"USN-6531-1","title":"redis vulnerabilities","description":"Seiya Nakata and Yudai Fujiwara discovered that Redis incorrectly handled\ncertain specially crafted Lua scripts. An attacker could possibly use this\nissue to cause heap corruption and execute arbitrary code.\n(CVE-2022-24834)\n\nSeungHyun Lee discovered that Redis incorrectly handled specially crafted\ncommands. An attacker could possibly use this issue to trigger an integer\noverflow, which might cause Redis to allocate impossible amounts of memory,\nresulting in a denial of service via an application crash. (CVE-2022-35977)\n\nTom Levy discovered that Redis incorrectly handled crafted string matching\npatterns. An attacker could possibly use this issue to cause Redis to hang,\nresulting in a denial of service. (CVE-2022-36021)\n\nYupeng Yang discovered that Redis incorrectly handled specially crafted\ncommands. An attacker could possibly use this issue to trigger an integer\noverflow, resulting in a denial of service via an application crash.\n(CVE-2023-25155)\n\nIt was discovered that Redis incorrectly handled a specially crafted\ncommand. An attacker could possibly use this issue to create an invalid\nhash field, which could potentially cause Redis to crash on future access.\n(CVE-2023-28856)\n\nAlexander Aleksandrovič Klimov discovered that Redis incorrectly listened\nto a Unix socket before setting proper permissions. A local attacker could\npossibly use this issue to connect, bypassing intended permissions.\n(CVE-2023-45145)\n","status":"published","published":"2023-12-05T16:35:31Z","modified":"2026-06-29T13:51:00.478762948Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}