linenoise, as used in Redis before 3.2.3, uses world-readable permissions for .rediscli_history, which allows local users to obtain sensitive information by reading the file.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1524 advisory.

    This advisory aggregates security fixes for the redis SRPM in CIQ LTS 9.2. It addresses 7 CVEs:
    CVE-2024-46981, CVE-2025-32023, CVE-2024-31449, CVE-2025-21605, CVE-2025-46817, and 2 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Redis installed on the remote host is affected by a local information disclosure and therefore requires a security update.

Upstream 3.2.8

----

Upstream 3.2.7 (important security fix)

----

Security fix for CVE-2013-7458

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Redis team reports :

The redis-cli history file (in linenoise) is created with the default OS umask value which makes it world readable in most systems and could potentially expose authentication credentials to other users.

This update for redis fixes the following issues :

  - CVE-2013-7458: unsafe permissions of command line     history (boo#991250)

It was discovered that redis, a persistent key-value database, did not properly protect redis-cli history files: they were created by default with world-readable permissions.

Users and systems administrators may want to proactively change permissions on existing ~/rediscli_history files, instead of waiting for the updated redis-cli to do so the next time it is run.

It was discovered that the redis-cli tool in redis (an in-memory key-value database) created world-readable history files.

For Debian 7 'Wheezy', this issue has been fixed in redis version 2:2.4.14-1+deb7u1.

We recommend that you upgrade your redis packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
354139	Rocky Linux 9.2 [CIQ] Security Update: redis / redis-devel / redis-doc Multiple Vulnerabilities (ciqsa-2026_1524)	Nessus	Rocky Linux Local Security Checks	Local	critical
109322	Pivotal Software Redis < 3.2.3 Local Information Disclosure	Nessus	Misc.	Remote	low
100970	Fedora 24 : redis (2017-4b176c1694)	Nessus	Fedora Local Security Checks	Local	low
93991	FreeBSD : redis -- sensitive information leak through command history file (fa175f30-8c75-11e6-924a-60a44ce6887b)	Nessus	FreeBSD Local Security Checks	Local	low
92775	openSUSE Security Update : redis (openSUSE-2016-945)	Nessus	SuSE Local Security Checks	Local	low
92642	Debian DSA-3634-1 : redis - security update	Nessus	Debian Local Security Checks	Local	low
92640	Debian DLA-577-1 : redis security update	Nessus	Debian Local Security Checks	Local	low

Detections

Analytics

CVE-2013-7458

low

Tenable Plugins

critical

low

low

low

low

low

low