{"id":144522,"date":"2025-10-09T11:12:23","date_gmt":"2025-10-09T09:12:23","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-redis-i-valkey-pozvolyayushhie-vypolnit-kod-na-servere-pri-nalichii-dostupa-k-bd"},"modified":"2025-10-09T11:12:23","modified_gmt":"2025-10-09T09:12:23","slug":"uyazvimosti-v-redis-i-valkey-pozvolyayushhie-vypolnit-kod-na-servere-pri-nalichii-dostupa-k-bd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimosti-v-redis-i-valkey-pozvolyayushhie-vypolnit-kod-na-servere-pri-nalichii-dostupa-k-bd","title":{"rendered":"Luki w Redisie i Valkey, kt\u00f3re pozwalaj\u0105 na wykonanie kodu na serwerze przy dost\u0119pie do bazy danych","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Badacze z firmy Wiz wykryli w bazie danych Redis podatno\u015b\u0107 (CVE-2025-49844), kt\u00f3ra pozwala na zdalne wykonanie kodu (RCE) na serwerze. Problem otrzyma\u0142 najwy\u017cszy poziom zagro\u017cenia (CVSS score 10 z 10), a aby wykorzysta\u0107 t\u0119 podatno\u015b\u0107, atakuj\u0105cy musi mie\u0107 mo\u017cliwo\u015b\u0107 wysy\u0142ania \u017c\u0105da\u0144 do bazy danych Redis, kt\u00f3ra dopuszcza wykonywanie skrypt\u00f3w Lua przez u\u017cytkownik\u00f3w.    <\/p>\n<p>Opr\u00f3cz publicznie dost\u0119pnych instancji Redis, kt\u00f3re umo\u017cliwiaj\u0105 dost\u0119p bez uwierzytelnienia, podatno\u015b\u0107 pozwala na skompromitowanie system\u00f3w chmurowych i platform hostingowych wspieraj\u0105cych us\u0142ugi zwi\u0105zane z Redis. Wed\u0142ug firmy Wiz skanowanie sieci ujawnili oko\u0142o 330 tysi\u0119cy serwer\u00f3w Redis, kt\u00f3re akceptuj\u0105 po\u0142\u0105czenia, z czego oko\u0142o 60 tysi\u0119cy przyjmuje \u017c\u0105dania bez uwierzytelnienia. Oficjalny obraz kontenera Docker dostarczany przez projekt Redis jest skonfigurowany do dost\u0119pu bez uwierzytelnienia domy\u015blnie.       <\/p>\n<p>Podatno\u015b\u0107 spowodowana jest dost\u0119pem do ju\u017c zwolnionej pami\u0119ci (use-after-free), co ujawnia si\u0119 przy manipulacji zbieraczem \u015bmieci w specjalnie przygotowanym skrypcie Lua. Problem ten pozwala na obej\u015bcie izolacji sandboxowej \u015brodowiska Lua w Redis oraz wykonanie kodu w podstawowym systemie z uprawnieniami u\u017cytkownika, pod kt\u00f3rym dzia\u0142a baza danych. Warto zauwa\u017cy\u0107, \u017ce b\u0142\u0105d pozostawa\u0142 niezauwa\u017cony przez 13 lat. Badacze, kt\u00f3rzy dostrzegli problem, zaprezentowali dzia\u0142aj\u0105cy exploit, ale szczeg\u00f3\u0142y dotycz\u0105ce wykorzystywania nie zosta\u0142y jeszcze ujawnione, aby da\u0107 czas na zainstalowanie poprawek.    <\/p>\n<p>Podatno\u015b\u0107 wyst\u0119puje r\u00f3wnie\u017c w projekcie Valkey, rozwijaj\u0105cym fork Redis, dostarczanym w wi\u0119kszo\u015bci dystrybucji Linux, w tym RedHat Enterprise Linux 10. Podatno\u015b\u0107 zosta\u0142a usuni\u0119ta w wydaniach Redis 8.2.2, 8.0.4, 7.4.6, 7.2.11 oraz 6.2.20, a tak\u017ce w Valkey 8.1.4, 8.0.6 i 7.2.11. Status nowej wersji pakietu lub przygotowania poprawki w dystrybucjach mo\u017cna sprawdzi\u0107 na nast\u0119puj\u0105cych stronach: Debian, Ubuntu, Fedora, SUSE\/openSUSE, RHEL, Gentoo, Arch, FreeBSD, OpenBSD i NetBSD. Jako obej\u015bcie ochrony w bazie danych mo\u017cna wy\u0142\u0105czy\u0107 wykonywanie skrypt\u00f3w Lua, zabraniaj\u0105c komend EVAL i EVALSHA za pomoc\u0105 ACL.    <\/p>\n<p>Dodatkowo mo\u017cna wskaza\u0107 jeszcze trzy podatno\u015bci, kt\u00f3re s\u0105 wykorzystywane za po\u015brednictwem skrypt\u00f3w Lua i zosta\u0142y usuni\u0119te w ostatnich wersjach Redis i Valkey. W celu ochrony przed tymi podatno\u015bciami poprzez ACL mo\u017cna zakaza\u0107 rodzin komend EVAL i FUNCTION.    <\/p>\n<ul>\n<li class=\"l\"> CVE-2025-46817 \u2014 przepe\u0142nienie ca\u0142kowite w funkcjach bibliotecznych Lua, potencjalnie umo\u017cliwiaj\u0105ce wykonanie w\u0142asnego kodu po stronie <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/pl\/server\/dts-los-angeles\/\"   title=\"serwera\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"3984\">serwera<\/a> przy uruchamianiu specjalnie przygotowanych skrypt\u00f3w Lua.\n<li class=\"l\"> CVE-2025-46819 \u2014 b\u0142\u0105d prowadz\u0105cy do odczytu danych z obszaru poza buforem podczas wykonywania specjalnie przygotowanego skryptu Lua. Luka ta mo\u017ce by\u0107 wykorzystywana do awaryjnego zako\u0144czenia procesu serwera Redis.\n<li class=\"l\"> CVE-2025-46818 \u2014 mo\u017cliwo\u015b\u0107 wykonywania polece\u0144 w kontek\u015bcie innego u\u017cytkownika bazy danych podczas manipulacji obiektami LUA z przy przygotowanym skryptem Lua.        <\/ul>\n<p>\u0179r\u00f3d\u0142o: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=64022\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Wiz \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432 \u0421\u0423\u0411\u0414 Redis \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-49844), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 (RCE) \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043d\u0430\u0438\u0432\u044b\u0441\u0448\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (CVSS score 10 \u0438\u0437 10), \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0434\u043e\u043b\u0436\u0435\u043d \u0438\u043c\u0435\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043a \u0421\u0423\u0411\u0414 Redis, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0435\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 Lua-\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432. \u041f\u043e\u043c\u0438\u043c\u043e \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u043e\u0432 Redis, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0445 \u0434\u043e\u0441\u0442\u0443\u043f \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-144522","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Wiz \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432 \u0421\u0423\u0411\u0414 Redis \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-49844), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 (RCE) \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimosti-v-redis-i-valkey-pozvolyayushhie-vypolnit-kod-na-servere-pri-nalichii-dostupa-k-bd\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"pl_PL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Redis \u0438 Valkey, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0411\u0414 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Wiz \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432 \u0421\u0423\u0411\u0414 Redis \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-49844), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 (RCE) \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimosti-v-redis-i-valkey-pozvolyayushhie-vypolnit-kod-na-servere-pri-nalichii-dostupa-k-bd\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-10-09T09:12:23+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2025-10-09T09:12:23+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Luki w Redis i Valkey, kt\u00f3re umo\u017cliwiaj\u0105 wykonanie kodu na serwerze przy dost\u0119pie do bazy danych | ProHoster","description":"Badacze z firmy Wiz odkryli w bazie danych Redis luk\u0119 (CVE-2025-49844), kt\u00f3ra umo\u017cliwia zdalne wykonanie kodu (RCE) na serwerze.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimosti-v-redis-i-valkey-pozvolyayushhie-vypolnit-kod-na-servere-pri-nalichii-dostupa-k-bd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Redis \u0438 Valkey, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0411\u0414 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Wiz \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432 \u0421\u0423\u0411\u0414 Redis \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-49844), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 (RCE) \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimosti-v-redis-i-valkey-pozvolyayushhie-vypolnit-kod-na-servere-pri-nalichii-dostupa-k-bd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-10-09T09:12:23+00:00","article:modified_time":"2025-10-09T09:12:23+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"144522","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 15:54:02","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 15:14:19","updated":"2026-02-22 15:54:02","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/144522","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=144522"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/144522\/revisions"}],"predecessor-version":[{"id":162513,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/144522\/revisions\/162513"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=144522"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=144522"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=144522"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}