Synopsis
The remote Debian host is missing one or more security-related updates.
Description
The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3885 advisory.
- ------------------------------------------------------------------------- Debian LTS Advisory DLA-3885-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb September 10, 2024 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : redis Version : 5:6.0.16-1+deb11u3 CVE IDs : CVE-2023-45145 CVE-2023-28856 CVE-2023-25155 CVE-2022-36021 CVE-2022-24834 Debian Bugs : 1032279 1034613 1054225
It was discovered that there were a number of issues in Redis, a popular key-value database:
* CVE-2023-45145: On startup, Redis began listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) was used, this created a race condition that enabled, during a short period of time, another process to establish an otherwise unauthorized connection.
* CVE-2023-28856: Authenticated users could have used the HINCRBYFLOAT command to create an invalid hash field that would have crashed the Redis server on access.
* CVE-2023-25155: Authenticated users issuing specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process.
* CVE-2022-36021: Authenticated users can use string matching commands (like SCAN or KEYS) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time.
* CVE-2022-24834: A specially-crafted Lua script executing in Redis could have triggered a heap overflow in the cjson and cmsgpack libraries and result in heap corruption and potentially remote code execution.
For Debian 11 bullseye, these problems have been fixed in version 5:6.0.16-1+deb11u3.
We recommend that you upgrade your redis packages.
For the detailed security status of redis please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/redis
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS
Tenable has extracted the preceding description block directly from the Debian security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade the redis packages.
Plugin Details
File Name: debian_DLA-3885.nasl
Agent: unix
Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus
Risk Information
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:debian:debian_linux:11.0, p-cpe:/a:debian:debian_linux:redis, p-cpe:/a:debian:debian_linux:redis-tools, p-cpe:/a:debian:debian_linux:redis-server, p-cpe:/a:debian:debian_linux:redis-sentinel
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Ease: No known exploits are available
Patch Publication Date: 9/10/2024
Vulnerability Publication Date: 3/1/2023