{"id":144522,"date":"2025-10-09T11:12:23","date_gmt":"2025-10-09T09:12:23","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-redis-i-valkey-pozvolyayushhie-vypolnit-kod-na-servere-pri-nalichii-dostupa-k-bd"},"modified":"2025-10-09T11:12:23","modified_gmt":"2025-10-09T09:12:23","slug":"uyazvimosti-v-redis-i-valkey-pozvolyayushhie-vypolnit-kod-na-servere-pri-nalichii-dostupa-k-bd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-redis-i-valkey-pozvolyayushhie-vypolnit-kod-na-servere-pri-nalichii-dostupa-k-bd","title":{"rendered":"Vulnerability in Redis and Valkey, allowing code execution on the server with database access.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Wiz'i uurimist\u00f6\u00f6tajad avastasid Redis andmebaasis haavatavuse (CVE-2025-49844), mis v\u00f5imaldab koodi kaugk\u00e4ivitamist (RCE) serveris. Probleemile on antud k\u00f5rgeim ohuaste (CVSS skoor 10 skaalal 10), kuid haavatavuse \u00e4rakasutamiseks peab r\u00fcndaja saama saata p\u00e4ringuid Redis andmebaasile, mis lubab kasutaja definitsiooniga Lua-skripte.    <\/p>\n<p>Lisaks avalikult ligip\u00e4\u00e4setavatele Redis'i eksemplaridele, mis v\u00f5imaldavad autentimata juurdep\u00e4\u00e4su, v\u00f5imaldab haavatavus kompromiteerida pilve s\u00fcsteeme ja hostimisteenuseid, mis toetavad Redis'i t\u00f6\u00f6tlusteenuseid. Wiz'i andmetel tuvastas v\u00f5rguskaneerimine umbes 330 000 Redis-serverit, millest umbes 60 000 aktsepteerivad p\u00e4ringuid ilma autentimiseta. Redis'i ametlik Docker-konteineri pilt on vaikimisi seadistatud autentimiseta juurdep\u00e4\u00e4suks.       <\/p>\n<p>Haavatavus tuleneb juba vabastatud m\u00e4lu kasutamisest (use-after-free), mis ilmneb j\u00e4\u00e4tme kogumise halduriga manipuleerimisel spetsiaalselt vormistatud Lua-skripti kaudu. Probleem v\u00f5imaldab m\u00f6\u00f6da minna Lua-isolatsiooni liivakasti s\u00fcsteemist Redis' ja k\u00e4ivitada koodi peamises s\u00fcsteemis kasutaja \u00f5igustes, kelle akses  andmebaas t\u00f6\u00f6tab. M\u00e4rkimisv\u00e4\u00e4rne on, et viga j\u00e4i m\u00e4rkamatuks 13 aastat. Probleemi avastanud teadlased demonstreerisid t\u00f6\u00f6korda viijat, kuid \u00e4rakasutuse detailid ei ole veel avalikustatud, et anda aega uuenduste paigaldamiseks.    <\/p>\n<p>Haavatavus ilmneb ka Valkey projektis, mis arendab Redis'e fork'i, mida tarnitakse enamikus Linuxi distributsioonides, sealhulgas RedHat Enterprise Linux 10. Haavatavus on k\u00f5rvaldatud Redis versioonides 8.2.2, 8.0.4, 7.4.6, 7.2.11 ja 6.2.20, samuti Valkey versioonides 8.1.4, 8.0.6 ja 7.2.11. Uue versiooni paketi seisundi v\u00f5i paranduste ettevalmistamise kontrollimiseks distributsioonides saab k\u00fclastada j\u00e4rgmisi lehti: Debian, Ubuntu, Fedora, SUSE\/openSUSE, RHEL, Gentoo, Arch, FreeBSD, OpenBSD ja NetBSD. Ajutise kaitsemeetmena andmebaasis saab keelata Lua-skripti k\u00e4itamise, piirates EVAL ja EVALSHA k\u00e4ske ACL kaudu.    <\/p>\n<p>Lisaks v\u00f5ib mainida veel kolme haavatavust, mida kasutavad \u00e4ra Lua-skripti ja mis on k\u00f5rvaldatud viimastes versioonides Redis ja Valkey. Nende haavatavuste jaoks ACL kaudu kaitsmiseks saab keelata EVAL ja FUNCTION k\u00e4su pered.    <\/p>\n<ul>\n<li class=\"l\"> CVE-2025-46817 \u2014 t\u00e4isarvude \u00fclevool Lua funktsioonides, mis v\u00f5ib potentsiaalselt v\u00f5imaldada koodide k\u00e4ivitamist serveripoolsetes keskkondades. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/et\/server\/dts-los-angeles\/\"   title=\"serverilt\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"3984\">serverilt<\/a> spetsiaalselt kujundatud Lua skriptide k\u00e4ivitamisel.\n<li class=\"l\"> CVE-2025-46819 \u2014 viga, mis p\u00f5hjustab andmete lugemise puhversoost v\u00e4ljaspool, kui t\u00e4idetakse spetsiaalselt valmistatud Lua skript. Haavatavust saab kasutada Redis serveriprotsessi kokku kukutamiseks.\n<li class=\"l\"> CVE-2025-46818 \u2014 v\u00f5imalus k\u00e4ivitada k\u00e4ske teise andmebaasi kasutaja kontekstis, manipuleerides LUA objektidega spetsiaalselt valmistatud Lua skriptist.        <\/ul>\n<p>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=64022\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Wiz \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432 \u0421\u0423\u0411\u0414 Redis \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-49844), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 (RCE) \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043d\u0430\u0438\u0432\u044b\u0441\u0448\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (CVSS score 10 \u0438\u0437 10), \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0434\u043e\u043b\u0436\u0435\u043d \u0438\u043c\u0435\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043a \u0421\u0423\u0411\u0414 Redis, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0435\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 Lua-\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432. \u041f\u043e\u043c\u0438\u043c\u043e \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u043e\u0432 Redis, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0445 \u0434\u043e\u0441\u0442\u0443\u043f \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-144522","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Wiz \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432 \u0421\u0423\u0411\u0414 Redis \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-49844), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 (RCE) \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-redis-i-valkey-pozvolyayushhie-vypolnit-kod-na-servere-pri-nalichii-dostupa-k-bd\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Redis \u0438 Valkey, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0411\u0414 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Wiz \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432 \u0421\u0423\u0411\u0414 Redis \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-49844), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 (RCE) \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-redis-i-valkey-pozvolyayushhie-vypolnit-kod-na-servere-pri-nalichii-dostupa-k-bd\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-10-09T09:12:23+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2025-10-09T09:12:23+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavused Redis ja Valkey, mis v\u00f5imaldavad t\u00e4ita koodi serveris, kui andmebaasi juurde p\u00e4\u00e4seb | ProHoster","description":"Uurijad ettev\u00f5ttest Wiz avastasid Redis DBMS-is haavatavuse (CVE-2025-49844), mis v\u00f5imaldab saavutada kaugkoodi t\u00e4itmist (RCE) serveris.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-redis-i-valkey-pozvolyayushhie-vypolnit-kod-na-servere-pri-nalichii-dostupa-k-bd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Redis \u0438 Valkey, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0411\u0414 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Wiz \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432 \u0421\u0423\u0411\u0414 Redis \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-49844), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 (RCE) \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-redis-i-valkey-pozvolyayushhie-vypolnit-kod-na-servere-pri-nalichii-dostupa-k-bd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-10-09T09:12:23+00:00","article:modified_time":"2025-10-09T09:12:23+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"144522","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 15:54:02","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 15:14:19","updated":"2026-02-22 15:54:02","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/144522","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=144522"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/144522\/revisions"}],"predecessor-version":[{"id":162513,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/144522\/revisions\/162513"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=144522"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=144522"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=144522"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}