Detections
Analytics

Alpine: multiple redis packages: security update to 7.2.8-r0

high Tenable Self-Hosted Container Security Plugin ID 426557

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Redis is an open source, in-memory database that persists on disk. In versions starting at 2.6 and prior
 to 7.4.3, An unauthenticated client can cause unlimited growth of output buffers, until the server runs
 out of memory or is killed. By default, the Redis configuration does not limit the output buffer of normal
 clients (see client-output-buffer-limit). Therefore, the output buffer can grow unlimitedly over time. As
 a result, the service is exhausted and the memory is unavailable. When password authentication is enabled
 on the Redis server, but no password is provided, the client can still cause the output buffer to grow
 from "NOAUTH" responses until the system will run out of memory. This issue has been patched in version
 7.4.3. An additional workaround to mitigate this problem without patching the redis-server executable is
 to block access to prevent unauthenticated users from connecting to Redis. This can be done in different
 ways. Either using network access control tools like firewalls, iptables, security groups, etc, or
 enabling TLS and requiring users to authenticate using client side certificates. (CVE-2025-21605)

See Also

https://security.alpinelinux.org/vuln/CVE-2025-21605

Plugin Details

Severity: High

ID: 426557

Version: Revision 1.5

Type: Local

Published: 5/16/2025

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.67

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2025-21605

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 4/23/2025

Reference Information

CVE: CVE-2025-21605