CVE-2017-15047 Denial of service in n/a

Critical 9.8 Published 6 Oct 2017 Updated 5 Aug 2024

Attackers with limited machine access can crash Redis via an out-of-bounds array index in cluster configuration loading.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2017-15047?

CVE-2017-15047 is a critical denial of service vulnerability in n/a, published on 6 Oct 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The clusterLoadConfig function in cluster.c in Redis 4.0.2 allows attackers to cause a denial of service (out-of-bounds array index and application crash) or possibly have unspecified other impact by leveraging "limited access to the machine."

Weakness: CWE-119

Which versions are affected by CVE-2017-15047?

It affects 1 product.

Linux distribution packages (2)

`redis` SUSE:Package Hub 12	All versions	`4.0.6-12.1`
`redis` SUSE:Package Hub 12	All versions	`4.0.6-12.1`

Products include Redislabs Redis.

How do I fix CVE-2017-15047?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2017-15047 being exploited?

There is no known exploitation of CVE-2017-15047 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2017-15047, GHSA-68cf-q2m8-cxp4, MGASA-2018-0119, UBUNTU-CVE-2017-15047, openSUSE-SU-2018:0225-1, openSUSE-SU-2018:0228-1.