The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4240 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4240-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                           Chris Lamb     July 12, 2025                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : redis     Version        : 5:6.0.16-1+deb11u7     CVE IDs        : CVE-2025-32023 CVE-2025-48367     Debian Bugs    : 1108975 1108981

    Two issues were discovered in Redis, the key-value database:

    * CVE-2025-32023: An authenticated user may have used a       specially-crafted string to trigger a stack/heap out-of-bounds       write during hyperloglog operations, potentially leading to a       remote code execution vulnerability. Installations that used Redis'       ACL system to restrict hyperloglog HLL commands are unaffected by       this issue.

    * CVE-2025-48367: An unauthenticated connection could have caused       repeated IP protocol errors, leading to client starvation and       ultimately become a Denial of Service (DoS) attack.

    For Debian 11 bullseye, these problems have been fixed in version     5:6.0.16-1+deb11u7.

    We recommend that you upgrade your redis packages.

    For the detailed security status of redis please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/redis

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-4240 : redis - security update

high Nessus Plugin ID 242032

Version 1.2

Version 1.1

Version 1.2 Jan 21, 2026, 5:00 PM IAVM reference Plugin Feed: 202601211700
Version 1.1 Jul 13, 2025, 8:50 PM New Plugin Feed: 202507132050