kritisch
CVE-2025-27151
redis: Redis Stack Buffer Overflow
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat2.5CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, Bitnami, Photon OS. Niedriger laut AlmaLinux (hoch), Oracle (hoch), Rocky Linux (hoch), Red Hat (mittel), Azure Linux (mittel), Ubuntu (mittel).
Beschreibung
Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution. This issue has been patched in version 8.0.2.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | keydb, redis, valkey | 7.2.9, 7.4.4, 8.0.2 und 1 weitere |
| Photon OS 4.0 | redis | 7.2.11-1.ph4 |
| Photon OS 5.0 | redis | 7.2.11-1.ph5 |
| alma 9 | redis:7::redis, redis:7::redis-devel, redis:7::redis-doc | 7.2.10-1.module_el9.6.0+173+efaf9205 |
| alpine 3.18 | redis | 7.0.15-r4 |
| alpine 3.19 | redis | 7.2.9-r0 |
| alpine 3.20 | redict, redis, valkey | 7.3.3-r1 und 2 weitere |
| alpine 3.21 | redict, redis, valkey | 7.3.3-r1 und 2 weitere |
| alpine 3.22 | redict, redis, valkey | 7.3.3-r1 und 2 weitere |
| alpine 3.23 | redict, redis, valkey | 7.3.3-r1 und 2 weitere |
| alpine 3.24 | redict, redis, valkey | 7.3.3-r1 und 2 weitere |
| alpine edge | redict, redis, valkey | 7.3.3-r1 und 2 weitere |
Alle 99 Einträge aus 38 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | keydb | kein Fix angegeben |
| bitnami::Bitnami Vulnerability Database | redis | 7.2.9, 7.4.4, 8.0.2 |
| bitnami::Bitnami Vulnerability Database | valkey | 7.2.10, 8.0.5, 8.1.2 |
| Photon OS 4.0 | redis | 7.2.11-1.ph4 |
| Photon OS 5.0 | redis | 7.2.11-1.ph5 |
| alma 9 | redis:7::redis | 7.2.10-1.module_el9.6.0+173+efaf9205 |
| alma 9 | redis:7::redis-devel | 7.2.10-1.module_el9.6.0+173+efaf9205 |
| alma 9 | redis:7::redis-doc | 7.2.10-1.module_el9.6.0+173+efaf9205 |
| alpine 3.18 | redis | 7.0.15-r4 |
| alpine 3.19 | redis | 7.2.9-r0 |
| alpine 3.20 | redict | 7.3.3-r1 |
| alpine 3.20 | redis | 7.2.9-r0 |
| alpine 3.20 | valkey | 7.2.9-r1 |
| alpine 3.21 | redict | 7.3.3-r1 |
| alpine 3.21 | redis | 7.2.9-r0 |
| alpine 3.21 | valkey | 7.2.9-r1 |
| alpine 3.22 | redict | 7.3.3-r1 |
| alpine 3.22 | redis | 8.0.2-r0 |
| alpine 3.22 | valkey | 8.1.1-r1 |
| alpine 3.23 | redict | 7.3.3-r1 |
| alpine 3.23 | redis | 8.0.2-r0 |
| alpine 3.23 | valkey | 8.1.1-r1 |
| alpine 3.24 | redict | 7.3.3-r1 |
| alpine 3.24 | redis | 8.0.2-r0 |
| alpine 3.24 | valkey | 8.1.1-r1 |
| alpine edge | redict | 7.3.3-r1 |
| alpine edge | redis | 8.0.2-r0 |
| alpine edge | valkey | 8.1.1-r1 |
| Azure Linux 3.0 | valkey | 0:8.0.3-3.azl3 |
| chainguard | py3-redis | 0 |
| chainguard | redis-7.2 | 7.2.12-r2 |
| chainguard | redis-7.4 | 7.4.4-r1 |
| debian 12 | redis | 5:7.0.15-1~deb12u5 |
| debian 13 | redis | 5:8.0.2-2 |
| debian 13 | valkey | 8.1.1+dfsg1-1.1 |
| debian 14 | redict | 7.3.5+ds-1 |
| debian 14 | redis | 5:8.0.2-2 |
| debian 14 | valkey | 8.1.1+dfsg1-1.1 |
| echo | redis | 5:7.0.15-1~deb12u5 |
| echo | redis-7.2 | 7.2.10-e0 |
| echo | redis-7.4 | 7.4.5-e0 |
| echo | valkey | 8.1.1+dfsg1-1.1 |
| minimos | redis-7.2 | 7.2.9-r0 |
| minimos | redis-7.4 | 7.4.4-r0 |
| minimos | redis-8.0 | 8.0.2-r0 |
| Oracle Linux 9 | redis | 7.2.10-1.0.1.module+el9.6.0+90637+3ecf02e1 |
| Oracle Linux 9 | redis-devel | 7.2.10-1.0.1.module+el9.6.0+90637+3ecf02e1 |
| Oracle Linux 9 | redis-doc | 7.2.10-1.0.1.module+el9.6.0+90637+3ecf02e1 |
| rapidfort alma 9 | redis | 0:7.2.10-1.module+el9.6.0+23332+115a3b01 |
| rapidfort alma 9 | redis-devel | 0:7.2.10-1.module+el9.6.0+23332+115a3b01 |
| rapidfort alma 9 | redis-doc | 0:7.2.10-1.module+el9.6.0+23332+115a3b01 |
| rapidfort alpine 3.20 | redict | 7.3.3-r1 |
| rapidfort alpine 3.20 | redis | 7.2.9-r0 |
| rapidfort alpine 3.20 | valkey | 7.2.9-r1 |
| rapidfort alpine 3.21 | redict | 7.3.3-r1 |
| rapidfort alpine 3.21 | redis | 7.2.9-r0 |
| rapidfort alpine 3.21 | valkey | 7.2.9-r1 |
| rapidfort alpine 3.23 | redict | 7.3.3-r1 |
| rapidfort alpine 3.23 | redis | 7.2.9-r0 |
| rapidfort alpine 3.23 | valkey | 7.2.9-r1 |
| rapidfort alpine 3.24 | redict | 7.3.3-r1 |
| rapidfort alpine 3.24 | redis | 7.2.9-r0 |
| rapidfort alpine 3.24 | valkey | 7.2.9-r1 |
| rapidfort amazon linux 2023 | firefox | kein Fix angegeben |
| rapidfort debian 12 | redict | 0:7.3.5+ds-1 |
| rapidfort debian 12 | redis | 5:8.0.2-2 |
| rapidfort debian 12 | rf-redis | 5:8.0.2-2 |
| rapidfort debian 12 | valkey | 0:8.1.1+dfsg1-1.1 |
| rapidfort debian 13 | redict | 0:7.3.5+ds-1 |
| rapidfort debian 13 | redis | 5:8.0.2-2 |
| rapidfort debian 13 | rf-redis | 5:8.0.2-2 |
| rapidfort debian 13 | valkey | 0:8.1.1+dfsg1-1.1 |
| rapidfort Oracle Linux 10 | valkey | 0:8.0.4-1.el10_0 |
| rapidfort Oracle Linux 10 | valkey-devel | 0:8.0.4-1.el10_0 |
| rapidfort Oracle Linux 9 | redis | 0:7.2.10-1.module+el9.6.0+23332+115a3b01 |
| rapidfort Oracle Linux 9 | redis-devel | 0:7.2.10-1.module+el9.6.0+23332+115a3b01 |
| rapidfort Oracle Linux 9 | redis-doc | 0:7.2.10-1.module+el9.6.0+23332+115a3b01 |
| rapidfort Oracle Linux 9 | valkey | 8.0.6-1.el9 |
| rapidfort Oracle Linux 9 | valkey-devel | 8.0.6-1.el9 |
| rapidfort rocky 9 | redis | 0:7.2.10-1.module+el9.6.0+32323+e27e860a |
| rapidfort rocky 9 | redis-devel | 0:7.2.10-1.module+el9.6.0+32323+e27e860a |
| rapidfort ubuntu 20.04 | redis | 5:8.0.2-2 |
| rapidfort ubuntu 20.04 | redis-stack-server | 7.4.0-v5 |
| rapidfort ubuntu 20.04 | rf-redis | 5:8.0.2-2 |
| rapidfort ubuntu 22.04 | redis | 5:8.0.2-2 |
| rapidfort ubuntu 22.04 | redis-stack-server | 7.4.0-v5 |
| rapidfort ubuntu 22.04 | rf-redis | 5:8.0.2-2 |
| rapidfort ubuntu 24.04 | redis | 5:8.0.2-2 |
| rapidfort ubuntu 24.04 | redis-stack-server | 7.4.0-v5 |
| rapidfort ubuntu 24.04 | rf-redis | 5:8.0.2-2 |
| Red Hat | redis | kein Fix angegeben |
| Red Hat | redis-devel | kein Fix angegeben |
| Red Hat | redis-doc | kein Fix angegeben |
| rocky 10 | valkey | 8.0.4-1.el10_0 |
| rocky 10 | valkey-devel | 8.0.4-1.el10_0 |
| rocky 9 | redis:7::redis | 7.2.10-1.module+el9.6.0+32323+e27e860a |
| rocky 9 | redis:7::redis-devel | 7.2.10-1.module+el9.6.0+32323+e27e860a |
| rocky 9 | redis:7::redis-doc | 7.2.10-1.module+el9.6.0+32323+e27e860a |
| ubuntu 24.04 | redis | kein Fix angegeben |
Referenzen
- https://access.redhat.com/errata/RHSA-2025:12008
- https://access.redhat.com/security/cve/CVE-2025-27151
- https://bugzilla.redhat.com/2369153
- https://bugzilla.redhat.com/show_bug.cgi?id=2369153
- https://bugzilla.redhat.com/show_bug.cgi?id=2376857
- https://bugzilla.redhat.com/show_bug.cgi?id=2376858
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27151
Alle 20 Referenzen
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-32023
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48367
- https://errata.almalinux.org/9/ALSA-2025-12008.html
- https://errata.rockylinux.org/RLSA-2025:12008
- https://github.com/redis/redis/commit/643b5db235cb82508e72f11c7b4bbfc7dc39be56
- https://github.com/redis/redis/releases/tag/8.0.2
- https://github.com/redis/redis/security/advisories/GHSA-5453-q98w-cmvm
- https://github.com/valkey-io/valkey/releases
- https://linux.oracle.com/cve/CVE-2025-27151.html
- https://linux.oracle.com/errata/ELSA-2025-12008.html
- https://nvd.nist.gov/vuln/detail/CVE-2025-27151
- https://www.cve.org/CVERecord?id=CVE-2025-27151