Detections
Analytics
Alpine: multiple redis packages: security update to 7.0.8-r0
medium Tenable Self-Hosted Container Security Plugin ID 406927
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted
`SETRANGE` and `SORT(_RO)` commands can trigger an integer overflow, resulting with Redis attempting to
allocate impossible amounts of memory and abort with an out-of-memory (OOM) panic. The problem is fixed in
Redis versions 7.0.8, 6.2.9 and 6.0.17. Users are advised to upgrade. There are no known workarounds for
this vulnerability. (CVE-2022-35977)
- Redis is an in-memory database that persists on disk. Authenticated users can issue a `HRANDFIELD` or
`ZRANDMEMBER` command with specially crafted arguments to trigger a denial-of-service by crashing Redis
with an assertion failure. This problem affects Redis versions 6.2 or newer up to but not including 6.2.9
as well as versions 7.0 up to but not including 7.0.8. Users are advised to upgrade. There are no known
workarounds for this vulnerability. (CVE-2023-22458)
See Also
Plugin Details
Severity: Medium
ID: 406927
Version: Revision 1.29
Type: Local
Published: 10/31/2023
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.18
CVSS v2
Risk Factor: Medium
Base Score: 4.6
Temporal Score: 3.4
Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C
CVSS Score Source: CVE-2023-22458
CVSS v3
Risk Factor: Medium
Base Score: 5.5
Temporal Score: 4.8
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 1/10/2023
Reference Information
CVE: CVE-2022-35977, CVE-2023-22458