Threats Tagged 'cve-2025-27151'

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log. Security Fix(es): * redis: Redis Stack Buffer Overflow (CVE-2025-27151) * redis: Redis Unauthenticated Denial of Service (CVE-2025-48367) * redis: Redis Hyperloglog Out-of-Bounds Write Vulnerability (CVE-2025-32023) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A stack-based buffer overflow vulnerability exists in redis-check-aof component of Valkey (an advanced key-value store) in versions from 7.0.0 up to but not including 8.0.2. The flaw arises from unsafe use of memcpy with strlen(filepath) on a user-supplied file path, allowing potential stack overflow and code execution. This vulnerability is identified as CVE-2025-27151 and has been patched in version 8.0.2. Red Hat has issued an important security advisory with updates available for affected Red Hat Enterprise Linux 10 variants.

Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution. This issue has been patched in version 8.0.2.

MediumVulnerabilityGermanyFranceNetherlands+5#cve#cve-2025-27151#cwe-20