critique
CVE-2025-27151
redis: Redis Stack Buffer Overflow
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat2.5CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD, Bitnami, Photon OS. Plus basse selon AlmaLinux (élevée), Oracle (élevée), Rocky Linux (élevée), Red Hat (moyenne), Azure Linux (moyenne), Ubuntu (moyenne).
Description
Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution. This issue has been patched in version 8.0.2.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | keydb, redis, valkey | 7.2.9, 7.4.4, 8.0.2 et 1 autres |
| Photon OS 4.0 | redis | 7.2.11-1.ph4 |
| Photon OS 5.0 | redis | 7.2.11-1.ph5 |
| alma 9 | redis:7::redis, redis:7::redis-devel, redis:7::redis-doc | 7.2.10-1.module_el9.6.0+173+efaf9205 |
| alpine 3.18 | redis | 7.0.15-r4 |
| alpine 3.19 | redis | 7.2.9-r0 |
| alpine 3.20 | redict, redis, valkey | 7.3.3-r1 et 2 autres |
| alpine 3.21 | redict, redis, valkey | 7.3.3-r1 et 2 autres |
| alpine 3.22 | redict, redis, valkey | 7.3.3-r1 et 2 autres |
| alpine 3.23 | redict, redis, valkey | 7.3.3-r1 et 2 autres |
| alpine 3.24 | redict, redis, valkey | 7.3.3-r1 et 2 autres |
| alpine edge | redict, redis, valkey | 7.3.3-r1 et 2 autres |
Afficher les 99 entrées de 38 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | keydb | pas de correctif indiqué |
| bitnami::Bitnami Vulnerability Database | redis | 7.2.9, 7.4.4, 8.0.2 |
| bitnami::Bitnami Vulnerability Database | valkey | 7.2.10, 8.0.5, 8.1.2 |
| Photon OS 4.0 | redis | 7.2.11-1.ph4 |
| Photon OS 5.0 | redis | 7.2.11-1.ph5 |
| alma 9 | redis:7::redis | 7.2.10-1.module_el9.6.0+173+efaf9205 |
| alma 9 | redis:7::redis-devel | 7.2.10-1.module_el9.6.0+173+efaf9205 |
| alma 9 | redis:7::redis-doc | 7.2.10-1.module_el9.6.0+173+efaf9205 |
| alpine 3.18 | redis | 7.0.15-r4 |
| alpine 3.19 | redis | 7.2.9-r0 |
| alpine 3.20 | redict | 7.3.3-r1 |
| alpine 3.20 | redis | 7.2.9-r0 |
| alpine 3.20 | valkey | 7.2.9-r1 |
| alpine 3.21 | redict | 7.3.3-r1 |
| alpine 3.21 | redis | 7.2.9-r0 |
| alpine 3.21 | valkey | 7.2.9-r1 |
| alpine 3.22 | redict | 7.3.3-r1 |
| alpine 3.22 | redis | 8.0.2-r0 |
| alpine 3.22 | valkey | 8.1.1-r1 |
| alpine 3.23 | redict | 7.3.3-r1 |
| alpine 3.23 | redis | 8.0.2-r0 |
| alpine 3.23 | valkey | 8.1.1-r1 |
| alpine 3.24 | redict | 7.3.3-r1 |
| alpine 3.24 | redis | 8.0.2-r0 |
| alpine 3.24 | valkey | 8.1.1-r1 |
| alpine edge | redict | 7.3.3-r1 |
| alpine edge | redis | 8.0.2-r0 |
| alpine edge | valkey | 8.1.1-r1 |
| Azure Linux 3.0 | valkey | 0:8.0.3-3.azl3 |
| chainguard | py3-redis | 0 |
| chainguard | redis-7.2 | 7.2.12-r2 |
| chainguard | redis-7.4 | 7.4.4-r1 |
| debian 12 | redis | 5:7.0.15-1~deb12u5 |
| debian 13 | redis | 5:8.0.2-2 |
| debian 13 | valkey | 8.1.1+dfsg1-1.1 |
| debian 14 | redict | 7.3.5+ds-1 |
| debian 14 | redis | 5:8.0.2-2 |
| debian 14 | valkey | 8.1.1+dfsg1-1.1 |
| echo | redis | 5:7.0.15-1~deb12u5 |
| echo | redis-7.2 | 7.2.10-e0 |
| echo | redis-7.4 | 7.4.5-e0 |
| echo | valkey | 8.1.1+dfsg1-1.1 |
| minimos | redis-7.2 | 7.2.9-r0 |
| minimos | redis-7.4 | 7.4.4-r0 |
| minimos | redis-8.0 | 8.0.2-r0 |
| Oracle Linux 9 | redis | 7.2.10-1.0.1.module+el9.6.0+90637+3ecf02e1 |
| Oracle Linux 9 | redis-devel | 7.2.10-1.0.1.module+el9.6.0+90637+3ecf02e1 |
| Oracle Linux 9 | redis-doc | 7.2.10-1.0.1.module+el9.6.0+90637+3ecf02e1 |
| rapidfort alma 9 | redis | 0:7.2.10-1.module+el9.6.0+23332+115a3b01 |
| rapidfort alma 9 | redis-devel | 0:7.2.10-1.module+el9.6.0+23332+115a3b01 |
| rapidfort alma 9 | redis-doc | 0:7.2.10-1.module+el9.6.0+23332+115a3b01 |
| rapidfort alpine 3.20 | redict | 7.3.3-r1 |
| rapidfort alpine 3.20 | redis | 7.2.9-r0 |
| rapidfort alpine 3.20 | valkey | 7.2.9-r1 |
| rapidfort alpine 3.21 | redict | 7.3.3-r1 |
| rapidfort alpine 3.21 | redis | 7.2.9-r0 |
| rapidfort alpine 3.21 | valkey | 7.2.9-r1 |
| rapidfort alpine 3.23 | redict | 7.3.3-r1 |
| rapidfort alpine 3.23 | redis | 7.2.9-r0 |
| rapidfort alpine 3.23 | valkey | 7.2.9-r1 |
| rapidfort alpine 3.24 | redict | 7.3.3-r1 |
| rapidfort alpine 3.24 | redis | 7.2.9-r0 |
| rapidfort alpine 3.24 | valkey | 7.2.9-r1 |
| rapidfort amazon linux 2023 | firefox | pas de correctif indiqué |
| rapidfort debian 12 | redict | 0:7.3.5+ds-1 |
| rapidfort debian 12 | redis | 5:8.0.2-2 |
| rapidfort debian 12 | rf-redis | 5:8.0.2-2 |
| rapidfort debian 12 | valkey | 0:8.1.1+dfsg1-1.1 |
| rapidfort debian 13 | redict | 0:7.3.5+ds-1 |
| rapidfort debian 13 | redis | 5:8.0.2-2 |
| rapidfort debian 13 | rf-redis | 5:8.0.2-2 |
| rapidfort debian 13 | valkey | 0:8.1.1+dfsg1-1.1 |
| rapidfort Oracle Linux 10 | valkey | 0:8.0.4-1.el10_0 |
| rapidfort Oracle Linux 10 | valkey-devel | 0:8.0.4-1.el10_0 |
| rapidfort Oracle Linux 9 | redis | 0:7.2.10-1.module+el9.6.0+23332+115a3b01 |
| rapidfort Oracle Linux 9 | redis-devel | 0:7.2.10-1.module+el9.6.0+23332+115a3b01 |
| rapidfort Oracle Linux 9 | redis-doc | 0:7.2.10-1.module+el9.6.0+23332+115a3b01 |
| rapidfort Oracle Linux 9 | valkey | 8.0.6-1.el9 |
| rapidfort Oracle Linux 9 | valkey-devel | 8.0.6-1.el9 |
| rapidfort rocky 9 | redis | 0:7.2.10-1.module+el9.6.0+32323+e27e860a |
| rapidfort rocky 9 | redis-devel | 0:7.2.10-1.module+el9.6.0+32323+e27e860a |
| rapidfort ubuntu 20.04 | redis | 5:8.0.2-2 |
| rapidfort ubuntu 20.04 | redis-stack-server | 7.4.0-v5 |
| rapidfort ubuntu 20.04 | rf-redis | 5:8.0.2-2 |
| rapidfort ubuntu 22.04 | redis | 5:8.0.2-2 |
| rapidfort ubuntu 22.04 | redis-stack-server | 7.4.0-v5 |
| rapidfort ubuntu 22.04 | rf-redis | 5:8.0.2-2 |
| rapidfort ubuntu 24.04 | redis | 5:8.0.2-2 |
| rapidfort ubuntu 24.04 | redis-stack-server | 7.4.0-v5 |
| rapidfort ubuntu 24.04 | rf-redis | 5:8.0.2-2 |
| Red Hat | redis | pas de correctif indiqué |
| Red Hat | redis-devel | pas de correctif indiqué |
| Red Hat | redis-doc | pas de correctif indiqué |
| rocky 10 | valkey | 8.0.4-1.el10_0 |
| rocky 10 | valkey-devel | 8.0.4-1.el10_0 |
| rocky 9 | redis:7::redis | 7.2.10-1.module+el9.6.0+32323+e27e860a |
| rocky 9 | redis:7::redis-devel | 7.2.10-1.module+el9.6.0+32323+e27e860a |
| rocky 9 | redis:7::redis-doc | 7.2.10-1.module+el9.6.0+32323+e27e860a |
| ubuntu 24.04 | redis | pas de correctif indiqué |
Références
- https://access.redhat.com/errata/RHSA-2025:12008
- https://access.redhat.com/security/cve/CVE-2025-27151
- https://bugzilla.redhat.com/2369153
- https://bugzilla.redhat.com/show_bug.cgi?id=2369153
- https://bugzilla.redhat.com/show_bug.cgi?id=2376857
- https://bugzilla.redhat.com/show_bug.cgi?id=2376858
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27151
Les 20 références
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-32023
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48367
- https://errata.almalinux.org/9/ALSA-2025-12008.html
- https://errata.rockylinux.org/RLSA-2025:12008
- https://github.com/redis/redis/commit/643b5db235cb82508e72f11c7b4bbfc7dc39be56
- https://github.com/redis/redis/releases/tag/8.0.2
- https://github.com/redis/redis/security/advisories/GHSA-5453-q98w-cmvm
- https://github.com/valkey-io/valkey/releases
- https://linux.oracle.com/cve/CVE-2025-27151.html
- https://linux.oracle.com/errata/ELSA-2025-12008.html
- https://nvd.nist.gov/vuln/detail/CVE-2025-27151
- https://www.cve.org/CVERecord?id=CVE-2025-27151