Description Preview
Overview
CVE-2023-28425 affects Redis, an in-memory database that persists on disk. The vulnerability exists in the implementation of the MSETNX command, which allows setting multiple key-value pairs atomically only if none of the keys already exist. When this command is executed with specific parameters by an authenticated user, it can trigger a runtime assertion that causes the Redis server to crash. This vulnerability impacts Redis versions starting from 7.0.8 and prior to 7.0.10. The issue allows malicious authenticated users to cause denial of service by terminating the Redis server process, potentially affecting application availability and data integrity.
Remediation
To remediate this vulnerability, Redis users should upgrade to version 7.0.10 or later, which contains the fix for this issue. The patch was implemented in commit 48e0d4788434833b47892fe9f3d91be7687f25c9.
If immediate upgrade is not possible, consider implementing the following mitigations:
- Restrict Redis access to trusted users only
- Implement network-level controls to limit who can connect to Redis instances
- Consider disabling the MSETNX command if it's not required for your application
- Monitor Redis server logs for unexpected terminations that might indicate exploitation attempts
References
- Redis GitHub Security Advisory: https://github.com/redis/redis/security/advisories/GHSA-mvmm-4vq6-vw8c
- Redis 7.0.10 Release Notes: https://github.com/redis/redis/releases/tag/7.0.10
- Fix Commit: https://github.com/redis/redis/commit/48e0d4788434833b47892fe9f3d91be7687f25c9
- NetApp Security Advisory: https://security.netapp.com/advisory/ntap-20230413-0005/
Industry ExposureMost to leastThis section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
- Management of Companies & EnterprisesManagement of Companies & Enterprises
- Accommodation & Food ServicesAccommodation & Food Services
- Administrative, Support, Waste Management & Remediation ServicesAdministrative, Support, Waste Management & Remediation Services
- Agriculture, Forestry Fishing & HuntingAgriculture, Forestry Fishing & Hunting
- Arts, Entertainment & RecreationArts, Entertainment & Recreation
- ConstructionConstruction
- Educational ServicesEducational Services
- Finance and InsuranceFinance and Insurance
- Health Care & Social AssistanceHealth Care & Social Assistance
- InformationInformation
- ManufacturingManufacturing
- MiningMining
- Other Services (except Public Administration)Other Services (except Public Administration)
- Professional, Scientific, & Technical ServicesProfessional, Scientific, & Technical Services
- Public AdministrationPublic Administration
- Real Estate Rental & LeasingReal Estate Rental & Leasing
- Retail TradeRetail Trade
- Transportation & WarehousingTransportation & Warehousing
- UtilitiesUtilities
- Wholesale TradeWholesale Trade
