{"id":"CVE-2023-36824","published":"2023-07-11T16:16:16Z","modified":"2025-02-13T16:56:27Z","title":"Heap overflow in COMMAND GETKEYS and ACL evaluation in Redis","vendor":"redis","product":"redis","tier":"core","eol":null,"affectedVersions":[{"vendor":"redis","product":"redis","versions":[">= 7.0.0, < 7.0.12"]}],"description":{"text":"Redis is an in-memory database that persists on disk. In Redit 7.0 prior to 7.0.12, extracting key names from a command and a list of arguments may, in some cases, trigger a heap overflow and result in reading random heap memory, heap corruption and potentially remote code execution. Several scenarios that may lead to authenticated users executing a specially crafted `COMMAND GETKEYS` or `COMMAND GETKEYSANDFLAGS`and authenticated users who were set with ACL rules that match key names, executing a specially crafted command that refers to a variadic list of key names. The vulnerability is patched in Redis 7.0.12.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":7.4,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.77422,"percentile":0.99557,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":1,"pulses":[{"name":"ACTUALIZACION | Oracle Critical Patch Update Advisory - October 2023","url":"https://otx.alienvault.com/pulse/6531fa57b7edb6c002b800e5","created":"2023-10-20"}],"provenance":"machine"},"cwes":[{"id":"CWE-122","name":"Heap-based Buffer Overflow"},{"id":"CWE-131","name":"Incorrect Calculation of Buffer Size"}],"references":[{"url":"https://github.com/redis/redis/security/advisories/GHSA-4cfx-h9gq-xpx3","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/redis/redis/releases/tag/7.0.12","tags":["x_refsource_MISC"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TDNNH2ONMVNBQ6LUIAOAGDNFPKXNST5K/","tags":[]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MIF5MAGYARYUMRFK7PQI7HYXMK2HZE5T/","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20230814-0009/","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-40750","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-40750","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-07-11","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-36824","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":25.8,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.91,"detail":"percentile 0.9956"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":5.18,"detail":"base score 7.4"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}