CVE-2023-45145

Name of the Vulnerable Software and Affected Versions Redis versions prior to 6.2.14 Redis versions prior to 7.0.14 Redis versions prior to 7.2.2

Description Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0-RC1.

Recommendations For versions prior to 6.2.14, upgrade to version 6.2.14 or later. For versions prior to 7.0.14, upgrade to version 7.0.14 or later. For versions prior to 7.2.2, upgrade to version 7.2.2 or later. As a temporary workaround, consider disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory.