crítica
CVE-2025-27151
redis: Redis Stack Buffer Overflow
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat2.5CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Bitnami, Photon OS. Más baja según AlmaLinux (alta), Oracle (alta), Rocky Linux (alta), Red Hat (media), Azure Linux (media), Ubuntu (media).
Descripción
Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution. This issue has been patched in version 8.0.2.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | keydb, redis, valkey | 7.2.9, 7.4.4, 8.0.2 y 1 más |
| Photon OS 4.0 | redis | 7.2.11-1.ph4 |
| Photon OS 5.0 | redis | 7.2.11-1.ph5 |
| alma 9 | redis:7::redis, redis:7::redis-devel, redis:7::redis-doc | 7.2.10-1.module_el9.6.0+173+efaf9205 |
| alpine 3.18 | redis | 7.0.15-r4 |
| alpine 3.19 | redis | 7.2.9-r0 |
| alpine 3.20 | redict, redis, valkey | 7.3.3-r1 y 2 más |
| alpine 3.21 | redict, redis, valkey | 7.3.3-r1 y 2 más |
| alpine 3.22 | redict, redis, valkey | 7.3.3-r1 y 2 más |
| alpine 3.23 | redict, redis, valkey | 7.3.3-r1 y 2 más |
| alpine 3.24 | redict, redis, valkey | 7.3.3-r1 y 2 más |
| alpine edge | redict, redis, valkey | 7.3.3-r1 y 2 más |
Mostrar las 99 entradas de 38 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | keydb | sin corrección indicada |
| bitnami::Bitnami Vulnerability Database | redis | 7.2.9, 7.4.4, 8.0.2 |
| bitnami::Bitnami Vulnerability Database | valkey | 7.2.10, 8.0.5, 8.1.2 |
| Photon OS 4.0 | redis | 7.2.11-1.ph4 |
| Photon OS 5.0 | redis | 7.2.11-1.ph5 |
| alma 9 | redis:7::redis | 7.2.10-1.module_el9.6.0+173+efaf9205 |
| alma 9 | redis:7::redis-devel | 7.2.10-1.module_el9.6.0+173+efaf9205 |
| alma 9 | redis:7::redis-doc | 7.2.10-1.module_el9.6.0+173+efaf9205 |
| alpine 3.18 | redis | 7.0.15-r4 |
| alpine 3.19 | redis | 7.2.9-r0 |
| alpine 3.20 | redict | 7.3.3-r1 |
| alpine 3.20 | redis | 7.2.9-r0 |
| alpine 3.20 | valkey | 7.2.9-r1 |
| alpine 3.21 | redict | 7.3.3-r1 |
| alpine 3.21 | redis | 7.2.9-r0 |
| alpine 3.21 | valkey | 7.2.9-r1 |
| alpine 3.22 | redict | 7.3.3-r1 |
| alpine 3.22 | redis | 8.0.2-r0 |
| alpine 3.22 | valkey | 8.1.1-r1 |
| alpine 3.23 | redict | 7.3.3-r1 |
| alpine 3.23 | redis | 8.0.2-r0 |
| alpine 3.23 | valkey | 8.1.1-r1 |
| alpine 3.24 | redict | 7.3.3-r1 |
| alpine 3.24 | redis | 8.0.2-r0 |
| alpine 3.24 | valkey | 8.1.1-r1 |
| alpine edge | redict | 7.3.3-r1 |
| alpine edge | redis | 8.0.2-r0 |
| alpine edge | valkey | 8.1.1-r1 |
| Azure Linux 3.0 | valkey | 0:8.0.3-3.azl3 |
| chainguard | py3-redis | 0 |
| chainguard | redis-7.2 | 7.2.12-r2 |
| chainguard | redis-7.4 | 7.4.4-r1 |
| debian 12 | redis | 5:7.0.15-1~deb12u5 |
| debian 13 | redis | 5:8.0.2-2 |
| debian 13 | valkey | 8.1.1+dfsg1-1.1 |
| debian 14 | redict | 7.3.5+ds-1 |
| debian 14 | redis | 5:8.0.2-2 |
| debian 14 | valkey | 8.1.1+dfsg1-1.1 |
| echo | redis | 5:7.0.15-1~deb12u5 |
| echo | redis-7.2 | 7.2.10-e0 |
| echo | redis-7.4 | 7.4.5-e0 |
| echo | valkey | 8.1.1+dfsg1-1.1 |
| minimos | redis-7.2 | 7.2.9-r0 |
| minimos | redis-7.4 | 7.4.4-r0 |
| minimos | redis-8.0 | 8.0.2-r0 |
| Oracle Linux 9 | redis | 7.2.10-1.0.1.module+el9.6.0+90637+3ecf02e1 |
| Oracle Linux 9 | redis-devel | 7.2.10-1.0.1.module+el9.6.0+90637+3ecf02e1 |
| Oracle Linux 9 | redis-doc | 7.2.10-1.0.1.module+el9.6.0+90637+3ecf02e1 |
| rapidfort alma 9 | redis | 0:7.2.10-1.module+el9.6.0+23332+115a3b01 |
| rapidfort alma 9 | redis-devel | 0:7.2.10-1.module+el9.6.0+23332+115a3b01 |
| rapidfort alma 9 | redis-doc | 0:7.2.10-1.module+el9.6.0+23332+115a3b01 |
| rapidfort alpine 3.20 | redict | 7.3.3-r1 |
| rapidfort alpine 3.20 | redis | 7.2.9-r0 |
| rapidfort alpine 3.20 | valkey | 7.2.9-r1 |
| rapidfort alpine 3.21 | redict | 7.3.3-r1 |
| rapidfort alpine 3.21 | redis | 7.2.9-r0 |
| rapidfort alpine 3.21 | valkey | 7.2.9-r1 |
| rapidfort alpine 3.23 | redict | 7.3.3-r1 |
| rapidfort alpine 3.23 | redis | 7.2.9-r0 |
| rapidfort alpine 3.23 | valkey | 7.2.9-r1 |
| rapidfort alpine 3.24 | redict | 7.3.3-r1 |
| rapidfort alpine 3.24 | redis | 7.2.9-r0 |
| rapidfort alpine 3.24 | valkey | 7.2.9-r1 |
| rapidfort amazon linux 2023 | firefox | sin corrección indicada |
| rapidfort debian 12 | redict | 0:7.3.5+ds-1 |
| rapidfort debian 12 | redis | 5:8.0.2-2 |
| rapidfort debian 12 | rf-redis | 5:8.0.2-2 |
| rapidfort debian 12 | valkey | 0:8.1.1+dfsg1-1.1 |
| rapidfort debian 13 | redict | 0:7.3.5+ds-1 |
| rapidfort debian 13 | redis | 5:8.0.2-2 |
| rapidfort debian 13 | rf-redis | 5:8.0.2-2 |
| rapidfort debian 13 | valkey | 0:8.1.1+dfsg1-1.1 |
| rapidfort Oracle Linux 10 | valkey | 0:8.0.4-1.el10_0 |
| rapidfort Oracle Linux 10 | valkey-devel | 0:8.0.4-1.el10_0 |
| rapidfort Oracle Linux 9 | redis | 0:7.2.10-1.module+el9.6.0+23332+115a3b01 |
| rapidfort Oracle Linux 9 | redis-devel | 0:7.2.10-1.module+el9.6.0+23332+115a3b01 |
| rapidfort Oracle Linux 9 | redis-doc | 0:7.2.10-1.module+el9.6.0+23332+115a3b01 |
| rapidfort Oracle Linux 9 | valkey | 8.0.6-1.el9 |
| rapidfort Oracle Linux 9 | valkey-devel | 8.0.6-1.el9 |
| rapidfort rocky 9 | redis | 0:7.2.10-1.module+el9.6.0+32323+e27e860a |
| rapidfort rocky 9 | redis-devel | 0:7.2.10-1.module+el9.6.0+32323+e27e860a |
| rapidfort ubuntu 20.04 | redis | 5:8.0.2-2 |
| rapidfort ubuntu 20.04 | redis-stack-server | 7.4.0-v5 |
| rapidfort ubuntu 20.04 | rf-redis | 5:8.0.2-2 |
| rapidfort ubuntu 22.04 | redis | 5:8.0.2-2 |
| rapidfort ubuntu 22.04 | redis-stack-server | 7.4.0-v5 |
| rapidfort ubuntu 22.04 | rf-redis | 5:8.0.2-2 |
| rapidfort ubuntu 24.04 | redis | 5:8.0.2-2 |
| rapidfort ubuntu 24.04 | redis-stack-server | 7.4.0-v5 |
| rapidfort ubuntu 24.04 | rf-redis | 5:8.0.2-2 |
| Red Hat | redis | sin corrección indicada |
| Red Hat | redis-devel | sin corrección indicada |
| Red Hat | redis-doc | sin corrección indicada |
| rocky 10 | valkey | 8.0.4-1.el10_0 |
| rocky 10 | valkey-devel | 8.0.4-1.el10_0 |
| rocky 9 | redis:7::redis | 7.2.10-1.module+el9.6.0+32323+e27e860a |
| rocky 9 | redis:7::redis-devel | 7.2.10-1.module+el9.6.0+32323+e27e860a |
| rocky 9 | redis:7::redis-doc | 7.2.10-1.module+el9.6.0+32323+e27e860a |
| ubuntu 24.04 | redis | sin corrección indicada |
Referencias
- https://access.redhat.com/errata/RHSA-2025:12008
- https://access.redhat.com/security/cve/CVE-2025-27151
- https://bugzilla.redhat.com/2369153
- https://bugzilla.redhat.com/show_bug.cgi?id=2369153
- https://bugzilla.redhat.com/show_bug.cgi?id=2376857
- https://bugzilla.redhat.com/show_bug.cgi?id=2376858
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27151
Las 20 referencias
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-32023
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48367
- https://errata.almalinux.org/9/ALSA-2025-12008.html
- https://errata.rockylinux.org/RLSA-2025:12008
- https://github.com/redis/redis/commit/643b5db235cb82508e72f11c7b4bbfc7dc39be56
- https://github.com/redis/redis/releases/tag/8.0.2
- https://github.com/redis/redis/security/advisories/GHSA-5453-q98w-cmvm
- https://github.com/valkey-io/valkey/releases
- https://linux.oracle.com/cve/CVE-2025-27151.html
- https://linux.oracle.com/errata/ELSA-2025-12008.html
- https://nvd.nist.gov/vuln/detail/CVE-2025-27151
- https://www.cve.org/CVERecord?id=CVE-2025-27151