Bug 2257454 (CVE-2023-41056)

Summary:	CVE-2023-41056 redis: Heap Buffer Overflow may lead to potential remote code execution
Product:	[Other] Security Response	Reporter:	Marco Benatto <mbenatto>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	adudiak, agarcial, aileenc, amasferr, aoconnor, asegurap, bdettelb, caswilli, chazlett, dfreiber, drow, epacific, fjansen, gmalinko, hhorak, hkataria, janstey, jburrell, jcammara, jhardy, jmitchel, jneedle, jobarker, jorton, jsamir, jsherril, jtanner, kaycoth, kshier, luizcosta, mabashia, mkleinhe, mkudlej, nweather, oezr, pdelbell, rcollet, simaishi, smcdonal, stcannon, sthirugn, teagle, tfister, tjochec, vkrizan, vkumar, vmugicag, yguenane, zsadeh
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	redis 7.2.4, redis 7.0.15	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in Redis. When processing a certain sequence of payloads, Redis may incorrectly handle the resizing of memory buffers, leading to a heap-based buffer overflow, potentially resulting in a denial of service or remote code execution.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2257455, 2257456, 2257459
Bug Blocks:	2257453

Description Marco Benatto 2024-01-09 18:49:01 UTC

In some cases, Redis may incorrectly handle resizing of memory buffers which can result in incorrect accounting of buffer sizes and lead to heap overflow and potential remote code execution.

Reference:
https://github.com/redis/redis/security/advisories/GHSA-xr47-pcmx-fq2m

Comment 1 Marco Benatto 2024-01-09 18:49:24 UTC

Created redis tracking bugs for this issue:

Affects: epel-all [bug 2257456]
Affects: fedora-all [bug 2257455]