kritik
CVE-2025-27151
redis: Redis Stack Buffer Overflow
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat2.5CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, Bitnami, Photon OS. Daha düşük diyenler: AlmaLinux (yüksek), Oracle (yüksek), Rocky Linux (yüksek), Red Hat (orta), Azure Linux (orta), Ubuntu (orta).
Açıklama
Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution. This issue has been patched in version 8.0.2.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | keydb, redis, valkey | 7.2.9, 7.4.4, 8.0.2 ve 1 tane daha |
| Photon OS 4.0 | redis | 7.2.11-1.ph4 |
| Photon OS 5.0 | redis | 7.2.11-1.ph5 |
| alma 9 | redis:7::redis, redis:7::redis-devel, redis:7::redis-doc | 7.2.10-1.module_el9.6.0+173+efaf9205 |
| alpine 3.18 | redis | 7.0.15-r4 |
| alpine 3.19 | redis | 7.2.9-r0 |
| alpine 3.20 | redict, redis, valkey | 7.3.3-r1 ve 2 tane daha |
| alpine 3.21 | redict, redis, valkey | 7.3.3-r1 ve 2 tane daha |
| alpine 3.22 | redict, redis, valkey | 7.3.3-r1 ve 2 tane daha |
| alpine 3.23 | redict, redis, valkey | 7.3.3-r1 ve 2 tane daha |
| alpine 3.24 | redict, redis, valkey | 7.3.3-r1 ve 2 tane daha |
| alpine edge | redict, redis, valkey | 7.3.3-r1 ve 2 tane daha |
38 kaynaktaki 99 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | keydb | düzeltme belirtilmemiş |
| bitnami::Bitnami Vulnerability Database | redis | 7.2.9, 7.4.4, 8.0.2 |
| bitnami::Bitnami Vulnerability Database | valkey | 7.2.10, 8.0.5, 8.1.2 |
| Photon OS 4.0 | redis | 7.2.11-1.ph4 |
| Photon OS 5.0 | redis | 7.2.11-1.ph5 |
| alma 9 | redis:7::redis | 7.2.10-1.module_el9.6.0+173+efaf9205 |
| alma 9 | redis:7::redis-devel | 7.2.10-1.module_el9.6.0+173+efaf9205 |
| alma 9 | redis:7::redis-doc | 7.2.10-1.module_el9.6.0+173+efaf9205 |
| alpine 3.18 | redis | 7.0.15-r4 |
| alpine 3.19 | redis | 7.2.9-r0 |
| alpine 3.20 | redict | 7.3.3-r1 |
| alpine 3.20 | redis | 7.2.9-r0 |
| alpine 3.20 | valkey | 7.2.9-r1 |
| alpine 3.21 | redict | 7.3.3-r1 |
| alpine 3.21 | redis | 7.2.9-r0 |
| alpine 3.21 | valkey | 7.2.9-r1 |
| alpine 3.22 | redict | 7.3.3-r1 |
| alpine 3.22 | redis | 8.0.2-r0 |
| alpine 3.22 | valkey | 8.1.1-r1 |
| alpine 3.23 | redict | 7.3.3-r1 |
| alpine 3.23 | redis | 8.0.2-r0 |
| alpine 3.23 | valkey | 8.1.1-r1 |
| alpine 3.24 | redict | 7.3.3-r1 |
| alpine 3.24 | redis | 8.0.2-r0 |
| alpine 3.24 | valkey | 8.1.1-r1 |
| alpine edge | redict | 7.3.3-r1 |
| alpine edge | redis | 8.0.2-r0 |
| alpine edge | valkey | 8.1.1-r1 |
| Azure Linux 3.0 | valkey | 0:8.0.3-3.azl3 |
| chainguard | py3-redis | 0 |
| chainguard | redis-7.2 | 7.2.12-r2 |
| chainguard | redis-7.4 | 7.4.4-r1 |
| debian 12 | redis | 5:7.0.15-1~deb12u5 |
| debian 13 | redis | 5:8.0.2-2 |
| debian 13 | valkey | 8.1.1+dfsg1-1.1 |
| debian 14 | redict | 7.3.5+ds-1 |
| debian 14 | redis | 5:8.0.2-2 |
| debian 14 | valkey | 8.1.1+dfsg1-1.1 |
| echo | redis | 5:7.0.15-1~deb12u5 |
| echo | redis-7.2 | 7.2.10-e0 |
| echo | redis-7.4 | 7.4.5-e0 |
| echo | valkey | 8.1.1+dfsg1-1.1 |
| minimos | redis-7.2 | 7.2.9-r0 |
| minimos | redis-7.4 | 7.4.4-r0 |
| minimos | redis-8.0 | 8.0.2-r0 |
| Oracle Linux 9 | redis | 7.2.10-1.0.1.module+el9.6.0+90637+3ecf02e1 |
| Oracle Linux 9 | redis-devel | 7.2.10-1.0.1.module+el9.6.0+90637+3ecf02e1 |
| Oracle Linux 9 | redis-doc | 7.2.10-1.0.1.module+el9.6.0+90637+3ecf02e1 |
| rapidfort alma 9 | redis | 0:7.2.10-1.module+el9.6.0+23332+115a3b01 |
| rapidfort alma 9 | redis-devel | 0:7.2.10-1.module+el9.6.0+23332+115a3b01 |
| rapidfort alma 9 | redis-doc | 0:7.2.10-1.module+el9.6.0+23332+115a3b01 |
| rapidfort alpine 3.20 | redict | 7.3.3-r1 |
| rapidfort alpine 3.20 | redis | 7.2.9-r0 |
| rapidfort alpine 3.20 | valkey | 7.2.9-r1 |
| rapidfort alpine 3.21 | redict | 7.3.3-r1 |
| rapidfort alpine 3.21 | redis | 7.2.9-r0 |
| rapidfort alpine 3.21 | valkey | 7.2.9-r1 |
| rapidfort alpine 3.23 | redict | 7.3.3-r1 |
| rapidfort alpine 3.23 | redis | 7.2.9-r0 |
| rapidfort alpine 3.23 | valkey | 7.2.9-r1 |
| rapidfort alpine 3.24 | redict | 7.3.3-r1 |
| rapidfort alpine 3.24 | redis | 7.2.9-r0 |
| rapidfort alpine 3.24 | valkey | 7.2.9-r1 |
| rapidfort amazon linux 2023 | firefox | düzeltme belirtilmemiş |
| rapidfort debian 12 | redict | 0:7.3.5+ds-1 |
| rapidfort debian 12 | redis | 5:8.0.2-2 |
| rapidfort debian 12 | rf-redis | 5:8.0.2-2 |
| rapidfort debian 12 | valkey | 0:8.1.1+dfsg1-1.1 |
| rapidfort debian 13 | redict | 0:7.3.5+ds-1 |
| rapidfort debian 13 | redis | 5:8.0.2-2 |
| rapidfort debian 13 | rf-redis | 5:8.0.2-2 |
| rapidfort debian 13 | valkey | 0:8.1.1+dfsg1-1.1 |
| rapidfort Oracle Linux 10 | valkey | 0:8.0.4-1.el10_0 |
| rapidfort Oracle Linux 10 | valkey-devel | 0:8.0.4-1.el10_0 |
| rapidfort Oracle Linux 9 | redis | 0:7.2.10-1.module+el9.6.0+23332+115a3b01 |
| rapidfort Oracle Linux 9 | redis-devel | 0:7.2.10-1.module+el9.6.0+23332+115a3b01 |
| rapidfort Oracle Linux 9 | redis-doc | 0:7.2.10-1.module+el9.6.0+23332+115a3b01 |
| rapidfort Oracle Linux 9 | valkey | 8.0.6-1.el9 |
| rapidfort Oracle Linux 9 | valkey-devel | 8.0.6-1.el9 |
| rapidfort rocky 9 | redis | 0:7.2.10-1.module+el9.6.0+32323+e27e860a |
| rapidfort rocky 9 | redis-devel | 0:7.2.10-1.module+el9.6.0+32323+e27e860a |
| rapidfort ubuntu 20.04 | redis | 5:8.0.2-2 |
| rapidfort ubuntu 20.04 | redis-stack-server | 7.4.0-v5 |
| rapidfort ubuntu 20.04 | rf-redis | 5:8.0.2-2 |
| rapidfort ubuntu 22.04 | redis | 5:8.0.2-2 |
| rapidfort ubuntu 22.04 | redis-stack-server | 7.4.0-v5 |
| rapidfort ubuntu 22.04 | rf-redis | 5:8.0.2-2 |
| rapidfort ubuntu 24.04 | redis | 5:8.0.2-2 |
| rapidfort ubuntu 24.04 | redis-stack-server | 7.4.0-v5 |
| rapidfort ubuntu 24.04 | rf-redis | 5:8.0.2-2 |
| Red Hat | redis | düzeltme belirtilmemiş |
| Red Hat | redis-devel | düzeltme belirtilmemiş |
| Red Hat | redis-doc | düzeltme belirtilmemiş |
| rocky 10 | valkey | 8.0.4-1.el10_0 |
| rocky 10 | valkey-devel | 8.0.4-1.el10_0 |
| rocky 9 | redis:7::redis | 7.2.10-1.module+el9.6.0+32323+e27e860a |
| rocky 9 | redis:7::redis-devel | 7.2.10-1.module+el9.6.0+32323+e27e860a |
| rocky 9 | redis:7::redis-doc | 7.2.10-1.module+el9.6.0+32323+e27e860a |
| ubuntu 24.04 | redis | düzeltme belirtilmemiş |
Referanslar
- https://access.redhat.com/errata/RHSA-2025:12008
- https://access.redhat.com/security/cve/CVE-2025-27151
- https://bugzilla.redhat.com/2369153
- https://bugzilla.redhat.com/show_bug.cgi?id=2369153
- https://bugzilla.redhat.com/show_bug.cgi?id=2376857
- https://bugzilla.redhat.com/show_bug.cgi?id=2376858
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27151
20 referansın hepsi
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-32023
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48367
- https://errata.almalinux.org/9/ALSA-2025-12008.html
- https://errata.rockylinux.org/RLSA-2025:12008
- https://github.com/redis/redis/commit/643b5db235cb82508e72f11c7b4bbfc7dc39be56
- https://github.com/redis/redis/releases/tag/8.0.2
- https://github.com/redis/redis/security/advisories/GHSA-5453-q98w-cmvm
- https://github.com/valkey-io/valkey/releases
- https://linux.oracle.com/cve/CVE-2025-27151.html
- https://linux.oracle.com/errata/ELSA-2025-12008.html
- https://nvd.nist.gov/vuln/detail/CVE-2025-27151
- https://www.cve.org/CVERecord?id=CVE-2025-27151