Detections
Analytics

Debian dla-4682 : redis - security update

high Nessus Plugin ID 326665

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4682 advisory.

 - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4682-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb July 13, 2026 https://wiki.debian.org/LTS
 - -------------------------------------------------------------------------

 Package : redis Version : 5:7.0.15-1~deb12u8 CVE ID : CVE-2026-23631 CVE-2026-25243

 It was discovered that there were two issues in Redis, the in-memory key/value database:

 CVE-2026-23631

 An authenticated attacker could have exploited the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled (or could be disabled), which may have led to remote code execution. Installations that prevent users from executing Lua scripts were unaffected.

 CVE-2026-25243

 The RESTORE command did not properly validate serialized values.
 An authenticated attacker with permission to execute RESTORE could have suppled a crafted serialized payload that triggers invalid memory access and this could have led to remote code execution.

 For Debian 12 bookworm, these problems have been fixed in version 5:7.0.15-1~deb12u8.

 We recommend that you upgrade your redis packages.

 For the detailed security status of redis please refer to its security tracker page at:
 https://security-tracker.debian.org/tracker/redis

 Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the redis packages.

See Also

https://packages.debian.org/source/bookworm/redis

https://security-tracker.debian.org/tracker/CVE-2026-23631

https://security-tracker.debian.org/tracker/CVE-2026-25243

https://security-tracker.debian.org/tracker/source-package/redis

Plugin Details

Severity: High

ID: 326665

File Name: debian_DLA-4682.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 7/14/2026

Updated: 7/14/2026

Supported Sensors: Continuous Assessment, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.6

Percentile: 98.47

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-25243

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7.7

Threat Score: 5.2

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:redis, p-cpe:/a:debian:debian_linux:redis-tools, p-cpe:/a:debian:debian_linux:redis-server, cpe:/o:debian:debian_linux:12.0, p-cpe:/a:debian:debian_linux:redis-sentinel

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 7/13/2026

Vulnerability Publication Date: 5/5/2026

Reference Information

CVE: CVE-2026-23631, CVE-2026-25243

IAVA: 2026-A-0426