CVE-2013-7458

low-risk

Published 2016-08-10

linenoise, as used in Redis before 3.2.3, uses world-readable permissions for .rediscli_history, which allows local users to obtain sensitive information by reading the file.

Do I need to act?

0.02% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 3.3/10 Low

LOCAL / LOW complexity

Affected Products (2)

Debian Linux

Redis

Affected Vendors

Redislabs Debian

References (20)

Mailing List http://lists.opensuse.org/opensuse-updates/2016-08/msg00029.html

Mailing List http://lists.opensuse.org/opensuse-updates/2016-08/msg00030.html

Third Party Advisory http://www.debian.org/security/2016/dsa-3634

Mailing List https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832460

Patch https://github.com/antirez/linenoise/issues/121

Patch https://github.com/antirez/linenoise/pull/122

Release Notes https://github.com/antirez/redis/blob/3.2/00-RELEASENOTES

Patch https://github.com/antirez/redis/issues/3284

Issue Tracking https://github.com/antirez/redis/pull/1418

Patch https://github.com/antirez/redis/pull/3322