CVE-2023-45145 in Oracle Communications Fraud Monitor

要約 (英語)

Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0-RC1. This issue has been addressed in Redis versions 7.2.2, 7.0.14 and 6.2.14. Users are advised to upgrade. For users unable to upgrade, it is possible to work around the problem by disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory.

責任者

GitHub, Inc.

予約する

2023年10月04日

公開

2023年10月25日

エントリ

VulDB provides additional information and datapoints for this CVE:

識別子	脆弱性	CWE	悪用可	対策	CVE
251051	Oracle Communications Fraud Monitor Infrastructure 情報漏えい	668	未定義	公式な修正	CVE-2023-45145
251050	Oracle Communications Cloud Native Core Network Repository Function Install/Upgrade 情報漏えい	668	未定義	公式な修正	CVE-2023-45145
242903	Redis 情報漏えい	668	未定義	公式な修正	CVE-2023-45145