CVE-2016-10517 Other in n/a

High 7.4 Published 24 Oct 2017 Updated 6 Aug 2024

Attackers can execute arbitrary commands or modify data by sending HTTP requests to the Redis port due to missing protocol validation.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2016-10517?

CVE-2016-10517 is a high-severity vulnerability in n/a, published on 24 Oct 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

networking.c in Redis before 3.2.7 allows "Cross Protocol Scripting" because it lacks a check for POST and Host: strings, which are not valid in the Redis protocol (but commonly occur when an attack triggers an HTTP request to the Redis TCP port).

Weakness: CWE-254

Which versions are affected by CVE-2016-10517?

It affects 1 product.

Linux distribution packages (2)

`redis` SUSE:Package Hub 12	All versions	`4.0.2-9.1`
`redis` SUSE:Package Hub 12	All versions	`4.0.2-9.1`

Products include Redislabs Redis.

How do I fix CVE-2016-10517?

Upgrade to a fixed version.

Is CVE-2016-10517 being exploited?

There is no known exploitation of CVE-2016-10517 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2016-10517, DLA-1161-1, GHSA-r965-fhrj-6v64, UBUNTU-CVE-2016-10517, openSUSE-SU-2017:2984-1, openSUSE-SU-2017:2994-1.