Detections
Analytics

SCA: security update for github.com/redis/go-redis/v9 (GHSA-92cp-5422-2mw7)

low Tenable Cloud Security Plugin ID 421168

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and
 9.7.3, go-redis potentially responds out of order when `CLIENT SETINFO` times out during connection
 establishment. This can happen when the client is configured to transmit its identity, there are network
 connectivity issues, or the client was configured with aggressive timeouts. The problem occurs for
 multiple use cases. For sticky connections, you receive persistent out-of-order responses for the lifetime
 of the connection. All commands in the pipeline receive incorrect responses. When used with the default
 ConnPool once a connection is returned after use with ConnPool#Put the read buffer will be checked and the
 connection will be marked as bad due to the unread data. This means that at most one out-of-order response
 before the connection is discarded. This issue is fixed in 9.5.5, 9.6.3, and 9.7.3. You can prevent the
 vulnerability by setting the flag DisableIndentity to true when constructing the client instance.
 (CVE-2025-29923)

See Also

https://github.com/advisories/GHSA-92cp-5422-2mw7

Plugin Details

Severity: Low

ID: 421168

Version: Revision 1.13

Type: Local

Family: SCA Checks

Published: 3/21/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: Low

Base Score: 2.6

Temporal Score: 1.9

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2025-29923

CVSS v3

Risk Factor: Low

Base Score: 3.7

Temporal Score: 3.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/20/2025

Vulnerability Publication Date: 3/20/2025

Reference Information

CVE: CVE-2025-29923

cwe: CWE-20