An update of the redis package has been released.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6020 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6020-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     October 08, 2025                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : redis     CVE ID         : CVE-2025-46817 CVE-2025-46818 CVE-2025-46819 CVE-2025-49844

    Multiple security issues were discovered in the Lua scripting interface     of Redis, a persistent key-value database, which could result in the     execution of arbitrary code or denial of service.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 5:7.0.15-1~deb12u6.

    For the stable distribution (trixie), these problems have been fixed in     version 5:8.0.2-3+deb13u1.

    We recommend that you upgrade your redis packages.

    For the detailed security status of redis please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/redis

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03499-1 advisory.

    - CVE-2025-49844: Malicious Lua scripts may lead to remote code execution.
      [bsc#1250995]

    - CVE-2025-46817: Malicious Lua scripts may lead to integer overflow and       potential remote code execution. [bsc#1250995]

    - CVE-2025-46818: Malicious Lua scripts can be executed in the context of       another user. [bsc#1250995]

    - CVE-2025-46819: Malicious Lua scripts can trigger out-of-bound reads to       facilitate denial-of-service attacks. [bsc#1250995]

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03506-1 advisory.

    - CVE-2025-49844: Malicious Lua scripts may lead to remote code execution.
      [bsc#1250995]

    - CVE-2025-46817: Malicious Lua scripts may lead to integer overflow and       potential remote code execution. [bsc#1250995]

    - CVE-2025-46818: Malicious Lua scripts can be executed in the context of       another user. [bsc#1250995]

    - CVE-2025-46819: Malicious Lua scripts can trigger out-of-bound reads to       facilitate denial-of-service attacks. [bsc#1250995]

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03505-1 advisory.

    - CVE-2025-49844: Malicious Lua scripts may lead to remote code execution.
      [bsc#1250995]

    - CVE-2025-46817: Malicious Lua scripts may lead to integer overflow and       potential remote code execution. [bsc#1250995]

    - CVE-2025-46818: Malicious Lua scripts can be executed in the context of       another user. [bsc#1250995]

    - CVE-2025-46819: Malicious Lua scripts can trigger out-of-bound reads to       facilitate denial-of-service attacks. [bsc#1250995]

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1222 advisory.

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an     authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead     to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is     fixed in version 8.2.2. (CVE-2025-46817)

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an     authenticated user to use a specially crafted Lua script to manipulate different LUA objects and     potentially run their own code in the context of another user. The problem exists in all versions of Redis     with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without     patching the redis-server executable is to prevent users from executing LUA scripts. This can be done     using ACL to block a script by restricting both the EVAL and FUNCTION command families. (CVE-2025-46818)

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an     authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and     subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. This issue     is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to     prevent users from executing Lua scripts. This can be done using ACL to block a script by restricting both     the EVAL and FUNCTION command families. (CVE-2025-46819)

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an     authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a     use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis     with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the     redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to     restrict EVAL and EVALSHA commands. (CVE-2025-49844)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of redis installed on the remote host is prior to 6.2.20-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2REDIS6-2025-015 advisory.

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an     authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead     to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is     fixed in version 8.2.2. (CVE-2025-46817)

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an     authenticated user to use a specially crafted Lua script to manipulate different LUA objects and     potentially run their own code in the context of another user. The problem exists in all versions of Redis     with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without     patching the redis-server executable is to prevent users from executing LUA scripts. This can be done     using ACL to block a script by restricting both the EVAL and FUNCTION command families. (CVE-2025-46818)

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an     authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and     subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. This issue     is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to     prevent users from executing Lua scripts. This can be done using ACL to block a script by restricting both     the EVAL and FUNCTION command families. (CVE-2025-46819)

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an     authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a     use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis     with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the     redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to     restrict EVAL and EVALSHA commands. (CVE-2025-49844)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-19237 advisory.

    [6.2.20-1]
    - rebase to 6.2.20 for CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 CVE-2025-46819

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:19238 advisory.

    * redis: Lua library commands may lead to integer overflow and potential RCE (CVE-2025-46817)
      * Redis: Redis: Authenticated users can execute LUA scripts as a different user (CVE-2025-46818)
      * Redis: Redis is vulnerable to DoS via specially crafted LUA scripts (CVE-2025-46819)
      * Redis: Redis Lua Use-After-Free may lead to remote code execution (CVE-2025-49844)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19675 advisory.

    Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can     contain strings, hashes, lists, sets and sorted sets.  You can run atomic operations on these types, like     appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection,     union and difference; or getting the member with highest ranking in a sorted set.  In order to achieve its     outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can     persist it either by dumping the dataset to disk every once in a while, or by appending each command to a     log.  Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first     synchronization, auto-reconnection on net split and so forth.  Other features include Transactions,     Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave     like a cache.  You can use Valkey from most programming languages also.

    Security Fix(es):

    * redis: Lua library commands may lead to integer overflow and potential RCE (CVE-2025-46817)

    * Redis: Redis: Authenticated users can execute LUA scripts as a different user (CVE-2025-46818)

    * Redis: Redis is vulnerable to DoS via specially crafted LUA scripts (CVE-2025-46819)

    * Redis: Redis Lua Use-After-Free may lead to remote code execution (CVE-2025-49844)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-19675 advisory.

    - Fix for CVE-2025-49844 [Orabug: 38515582]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:20926 advisory.

    Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can     contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data     set. You can persist it either by dumping the data set to disk every once in a while, or by appending each     command to a log.

    Security Fix(es):

    * redis: Lua library commands may lead to integer overflow and potential RCE (CVE-2025-46817)

    * Redis: Redis: Authenticated users can execute LUA scripts as a different user (CVE-2025-46818)

    * Redis: Redis is vulnerable to DoS via specially crafted LUA scripts (CVE-2025-46819)

    * Redis: Redis Lua Use-After-Free may lead to remote code execution (CVE-2025-49844)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:20955 advisory.

    Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can     contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data     set. You can persist it either by dumping the data set to disk every once in a while, or by appending each     command to a log.

    Security Fix(es):

    * redis: Lua library commands may lead to integer overflow and potential RCE (CVE-2025-46817)

    * Redis: Redis: Authenticated users can execute LUA scripts as a different user (CVE-2025-46818)

    * Redis: Redis is vulnerable to DoS via specially crafted LUA scripts (CVE-2025-46819)

    * Redis: Redis Lua Use-After-Free may lead to remote code execution (CVE-2025-49844)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:20926 advisory.

    * redis: Lua library commands may lead to integer overflow and potential RCE (CVE-2025-46817)
      * Redis: Redis: Authenticated users can execute LUA scripts as a different user (CVE-2025-46818)
      * Redis: Redis is vulnerable to DoS via specially crafted LUA scripts (CVE-2025-46819)
      * Redis: Redis Lua Use-After-Free may lead to remote code execution (CVE-2025-49844)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:21916 advisory.

    * redis: Lua library commands may lead to integer overflow and potential RCE (CVE-2025-46817)

    * Redis: Redis: Authenticated users can execute LUA scripts as a different user (CVE-2025-46818)

    * Redis: Redis is vulnerable to DoS via specially crafted LUA scripts (CVE-2025-46819)

    * Redis: Redis Lua Use-After-Free may lead to remote code execution (CVE-2025-49844)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
332262	Photon OS 5.0: Redis PHSA-2025-5.0-91-0676	Nessus	PhotonOS Local Security Checks	2026/8/5	2026/8/5	critical
269759	Debian dsa-6020 : redis - security update	Nessus	Debian Local Security Checks	2025/10/8	2026/1/21	critical
269786	SUSE SLES15 / openSUSE 15 Security Update : valkey (SUSE-SU-2025:03499-1)	Nessus	SuSE Local Security Checks	2025/10/9	2025/10/9	critical
269956	SUSE SLES15 Security Update : redis (SUSE-SU-2025:03506-1)	Nessus	SuSE Local Security Checks	2025/10/10	2025/11/18	critical
269957	SUSE SLES15 / openSUSE 15 Security Update : redis (SUSE-SU-2025:03505-1)	Nessus	SuSE Local Security Checks	2025/10/10	2025/11/18	critical
270520	Amazon Linux 2023 : redis6, redis6-devel (ALAS2023-2025-1222)	Nessus	Amazon Linux Local Security Checks	2025/10/15	2025/11/18	critical
270551	Amazon Linux 2 : redis, --advisory ALAS2REDIS6-2025-015 (ALASREDIS6-2025-015)	Nessus	Amazon Linux Local Security Checks	2025/10/15	2025/11/18	critical
272067	Oracle Linux 9 : redis (ELSA-2025-19237)	Nessus	Oracle Linux Local Security Checks	2025/10/30	2025/11/18	critical
272069	AlmaLinux 8 : redis:6 (ALSA-2025:19238)	Nessus	Alma Linux Local Security Checks	2025/10/30	2025/10/30	critical
272280	RHEL 10 : valkey (RHSA-2025:19675)	Nessus	Red Hat Local Security Checks	2025/11/4	2025/11/4	critical
274078	Oracle Linux 10 : valkey (ELSA-2025-19675)	Nessus	Oracle Linux Local Security Checks	2025/11/5	2025/11/5	critical
274765	RHEL 9 : redis (RHSA-2025:20926)	Nessus	Red Hat Local Security Checks	2025/11/11	2025/11/11	critical
274824	RHEL 9 : redis:7 (RHSA-2025:20955)	Nessus	Red Hat Local Security Checks	2025/11/11	2025/11/11	critical
275820	AlmaLinux 9 : redis (ALSA-2025:20926)	Nessus	Alma Linux Local Security Checks	2025/11/19	2025/11/19	critical
276739	RockyLinux 9 : valkey (RLSA-2025:21916)	Nessus	Rocky Linux Local Security Checks	2025/11/25	2025/11/25	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical