CVE-2023-45145

Summary

CVE-2023-45145 is a vulnerability affecting Redis, an in-memory database that listens on a Unix socket during startup. If a permissive umask is used, this creates a race condition, allowing unauthorized connections before Redis adjusts its permissions. This issue, present since Redis 2.6.0-RC1, has been addressed in versions 7.2.2, 7.0.14, and 6.2.14. Users are advised to upgrade as soon as possible to mitigate the risk. Alternatively, disabling Unix sockets, using a restrictive umask, or storing the Unix socket file in a protected directory are workarounds for those unable to upgrade.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.