DEBIAN-CVE-2023-45145
Record from OSV · Published October 18, 2023
Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0-RC1. This issue has been addressed in Redis versions 7.2.2, 7.0.14 and 6.2.14. Users are advised to upgrade. For users unable to upgrade, it is possible to work around the problem by disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| redis | Debian:12 | 5:7.0.15-1~deb12u1 |
| redis | Debian:14 | 5:7.0.14-1 |
| redis | Debian:13 | 5:7.0.14-1 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Debian:12 | redis | 5:7.0.14-2, 5:7.0.13-2, 5:7.0.14-1 |
| Debian:14 | redis | 0 |
| Debian:13 | redis | 0 |
Timeline
- Oct 18, 2023 CVE Published
- Oct 26, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln DEBIAN-CVE-2023-45145
vulnetix vdb fixes DEBIAN-CVE-2023-45145Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/DEBIAN-CVE-2023-45145/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart