CVE-2016-10517

EUVD-2016-1698
networking.c in Redis before 3.2.7 allows "Cross Protocol Scripting" because it lacks a check for POST and Host: strings, which are not valid in the Redis protocol (but commonly occur when an attack triggers an HTTP request to the Redis TCP port).
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.4 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 50%
Affected Products (NVD)
VendorProductVersion
redislabsredis
𝑥
< 3.2.7
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
redis
bookworm
5:7.0.15-1~deb12u1
fixed
bookworm (security)
5:7.0.15-1~deb12u1
fixed
bullseye
5:6.0.16-1+deb11u2
fixed
bullseye (security)
5:6.0.16-1+deb11u3
fixed
jessie
no-dsa
sid
5:7.0.15-2
fixed
stretch
no-dsa
trixie
5:7.0.15-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
redis
artful
Fixed 4:4.0.1-7
released
bionic
not-affected
trusty
Fixed 2:2.8.4-2ubuntu0.2
released
xenial
Fixed 2:3.0.6-1ubuntu0.2
released
zesty
ignored
Common Weakness Enumeration
References
http://www.securityfocus.com/bid/101572
https://github.com/antirez/redis/commit/874804da0c014a7d704b3d285aa500098a931f50
https://raw.githubusercontent.com/antirez/redis/3.2/00-RELEASENOTES
https://www.reddit.com/r/redis/comments/5r8wxn/redis_327_is_out_important_security_fixes_inside/
http://www.securityfocus.com/bid/101572
https://github.com/antirez/redis/commit/874804da0c014a7d704b3d285aa500098a931f50
https://raw.githubusercontent.com/antirez/redis/3.2/00-RELEASENOTES
https://www.reddit.com/r/redis/comments/5r8wxn/redis_327_is_out_important_security_fixes_inside/