Detections
Analytics

RHEL 10 : valkey (RHSA-2025:19675)

critical Nessus Plugin ID 272280

Language:

Synopsis

The remote Red Hat host is missing one or more security updates for valkey.

Description

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19675 advisory.

 Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also.

 Security Fix(es):

 * redis: Lua library commands may lead to integer overflow and potential RCE (CVE-2025-46817)

 * Redis: Redis: Authenticated users can execute LUA scripts as a different user (CVE-2025-46818)

 * Redis: Redis is vulnerable to DoS via specially crafted LUA scripts (CVE-2025-46819)

 * Redis: Redis Lua Use-After-Free may lead to remote code execution (CVE-2025-49844)

 For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the RHEL valkey package based on the guidance in RHSA-2025:19675.

See Also

https://access.redhat.com/security/updates/classification/#important

https://bugzilla.redhat.com/show_bug.cgi?id=2401258

https://bugzilla.redhat.com/show_bug.cgi?id=2401292

https://bugzilla.redhat.com/show_bug.cgi?id=2401322

https://bugzilla.redhat.com/show_bug.cgi?id=2401324

http://www.nessus.org/u?b0207344

https://access.redhat.com/errata/RHSA-2025:19675

Plugin Details

Severity: Critical

ID: 272280

File Name: redhat-RHSA-2025-19675.nasl

Version: 1.1

Type: local

Agent: unix

Published: 11/4/2025

Updated: 11/4/2025

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 10.0

Vendor

Vendor Severity: Important

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2025-46817

CVSS v3

Risk Factor: Critical

Base Score: 9.9

Temporal Score: 8.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2025-49844

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:valkey-devel, cpe:/o:redhat:enterprise_linux:10.0, p-cpe:/a:redhat:enterprise_linux:valkey

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/4/2025

Vulnerability Publication Date: 10/3/2025

Reference Information

CVE: CVE-2025-46817, CVE-2025-46818, CVE-2025-46819, CVE-2025-49844

CWE: 190, 416, 94

RHSA: 2025:19675