CVE-2023-28425
published 2023-03-20CVE-2023-28425: Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to…
PriorityP341medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
58.53%
99.1th percentile
Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Redis version 7.0.10.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | redis | < redis 5:7.0.10-1 (bookworm) | redis 5:7.0.10-1 (bookworm) |
| msrc | cbl2_redis_6.2.12-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| msrc | cm1_redis_6.2.11-1_on_cbl_mariner_1.0 | — | — |
| redis | redis | — | — |
| redis | redis | >= 0 < 5:7.0.10-1 | 5:7.0.10-1 |
| redis | redis | >= 0 < 5:7.0.10-1 | 5:7.0.10-1 |
| redis | redis | >= 0 < 5:7.0.10-1 | 5:7.0.10-1 |
| redis | redis | >= 7.0.8 < 7.0.10 | 7.0.10 |
Detection & IOCsextracted from sources · hover to see the quote
- →Trigger condition: authenticated users sending the MSETNX command to a Redis 7.0.8–7.0.9 server can cause a runtime assertion and process termination (DoS) ↗
- →The vulnerability was introduced in Redis v7.0.8 and is only present in that specific version range; Redis v6.x and below are NOT affected and can be used to filter alerts ↗
- →A specially crafted MSETNX command is the attack vector; monitor Redis command logs for MSETNX usage followed by unexpected server process crashes ↗
- ·Only Redis versions 7.0.8 and 7.0.9 are vulnerable; the fix is present in 7.0.10 and later. Deployments running Redis ≤7.0.7 or ≥7.0.10 are not affected. ↗
- ·Exploitation requires an authenticated session; unauthenticated attackers cannot trigger this vulnerability. ↗
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
redis: Specially crafted MSETNX command can lead to denial-of-service
vendor_redhat·2023-03-20·CVSS 5.5
CVE-2023-28425 [MEDIUM] CWE-77 redis: Specially crafted MSETNX command can lead to denial-of-service
redis: Specially crafted MSETNX command can lead to denial-of-service
Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Redis version 7.0.10.
A command injection flaw was discovered in Redis, which exists due to a reachable assertion when handling the MSETNX command. By sending a specially crafted MSETNX command, a local authenticated attacker can cause a denial of service condition by terminating the Redis server process.
Statement: The vulnerability was introduced in Redis v7.0.8. Red Hat enterprise Linux - 8, 9 ships Redis v6.x.x and lower, which does not contain the vulnerable cod
Microsoft
Specially crafted MSETNX command can lead to denial-of-service
vendor_msrc·2023-03-14·CVSS 5.5
CVE-2023-28425 [MEDIUM] CWE-77 Specially crafted MSETNX command can lead to denial-of-service
Specially crafted MSETNX command can lead to denial-of-service
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference:
Debian
CVE-2023-28425: redis - Redis is an in-memory database that persists on disk. Starting in version 7.0.8 ...
vendor_debian·2023·CVSS 5.5
CVE-2023-28425 [MEDIUM] CVE-2023-28425: redis - Redis is an in-memory database that persists on disk. Starting in version 7.0.8 ...
Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Redis version 7.0.10.
Scope: local
bookworm: resolved (fixed in 5:7.0.10-1)
bullseye: resolved
forky: resolved (fixed in 5:7.0.10-1)
sid: resolved (fixed in 5:7.0.10-1)
trixie: resolved (fixed in 5:7.0.10-1)
OSV
CVE-2023-28425: Redis is an in-memory database that persists on disk
osv·2023-03-20·CVSS 5.5
CVE-2023-28425 [MEDIUM] CVE-2023-28425: Redis is an in-memory database that persists on disk
Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Redis version 7.0.10.
No detection rules found.
No public exploits indexed.
https://github.com/redis/redis/commit/48e0d4788434833b47892fe9f3d91be7687f25c9https://github.com/redis/redis/releases/tag/7.0.10https://github.com/redis/redis/security/advisories/GHSA-mvmm-4vq6-vw8chttps://security.netapp.com/advisory/ntap-20230413-0005/https://github.com/redis/redis/commit/48e0d4788434833b47892fe9f3d91be7687f25c9https://github.com/redis/redis/releases/tag/7.0.10https://github.com/redis/redis/security/advisories/GHSA-mvmm-4vq6-vw8chttps://security.netapp.com/advisory/ntap-20230413-0005/
2023-03-20
Published