{"id":144522,"date":"2025-10-09T11:12:23","date_gmt":"2025-10-09T09:12:23","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-redis-i-valkey-pozvolyayushhie-vypolnit-kod-na-servere-pri-nalichii-dostupa-k-bd"},"modified":"2025-10-09T11:12:23","modified_gmt":"2025-10-09T09:12:23","slug":"uyazvimosti-v-redis-i-valkey-pozvolyayushhie-vypolnit-kod-na-servere-pri-nalichii-dostupa-k-bd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-redis-i-valkey-pozvolyayushhie-vypolnit-kod-na-servere-pri-nalichii-dostupa-k-bd","title":{"rendered":"Vulnerabilit\u0103\u021bi \u00een Redis \u0219i Valkey, care permit executarea de cod pe server \u00een cazul \u00een care exist\u0103 acces la baza de date","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Cercet\u0103torii de la compania Wiz au identificat o vulnerabilitate \u00een SGBD-ul Redis (CVE-2025-49844), care permite executarea de cod de la distan\u021b\u0103 (RCE) pe server. Problema a fost clasificat\u0103 cu cel mai \u00eenalt nivel de gravitate (scor CVSS 10 din 10), iar pentru a exploata vulnerabilitatea, un atacator trebuie s\u0103 aib\u0103 capacitatea de a trimite cereri c\u0103tre SGBD-ul Redis, care permite executarea scripturilor Lua personalizate.    <\/p>\n<p>Pe l\u00e2ng\u0103 instan\u021bele publice de Redis, care ofer\u0103 acces f\u0103r\u0103 autentificare, vulnerabilitatea permite compromiterea sistemelor cloud \u0219i platformelor de g\u0103zduire care suport\u0103 servicii pentru lucrul cu Redis. Potrivit companiei Wiz, scanarea re\u021belei a identificat aproximativ 330.000 de servere Redis care accept\u0103 conexiuni, dintre care aproximativ 60.000 accept\u0103 cereri f\u0103r\u0103 autentificare. Imaginile oficiale ale containerului Docker furnizate de proiectul Redis sunt configurate pentru acces f\u0103r\u0103 autentificare \u00een mod implicit.       <\/p>\n<p>Vulnerabilitatea este cauzat\u0103 de accesarea memoriei deja eliberate (use-after-free), care apare \u00een timpul manipul\u0103rii colectorului de gunoi dintr-un script Lua special conceput. Problema permite ocolirea izol\u0103rii sandbox \u00een mediul Lua din Redis \u0219i executarea codului \u00een sistemul principal cu drepturile utilizatorului sub care ruleaz\u0103 SGBD-ul. Este demn de men\u021bionat c\u0103 eroarea a r\u0103mas neobservat\u0103 timp de 13 ani. Cercet\u0103torii care au descoperit problema au demonstrat un exploit func\u021bional, dar detaliile exploat\u0103rii nu sunt deocamdat\u0103 dezv\u0103luite pentru a oferi timp pentru instalarea actualiz\u0103rilor.    <\/p>\n<p>Vulnerabilitatea se manifest\u0103 \u0219i \u00een proiectul Valkey, care dezvolt\u0103 un fork al Redis, livrat \u00een majoritatea distribu\u021biilor Linux, inclusiv RedHat Enterprise Linux 10. Vulnerabilitatea a fost remediat\u0103 \u00een versiunile Redis 8.2.2, 8.0.4, 7.4.6, 7.2.11 \u0219i 6.2.20, precum \u0219i \u00een Valkey 8.1.4, 8.0.6 \u0219i 7.2.11. Starea noii versiuni a pachetului sau a preg\u0103tirii unui remediu \u00een distribu\u021bii poate fi verificat\u0103 pe urm\u0103toarele pagini: Debian, Ubuntu, Fedora, SUSE\/openSUSE, RHEL, Gentoo, Arch, FreeBSD, OpenBSD \u0219i NetBSD. Ca solu\u021bie temporar\u0103 de protec\u021bie \u00een SGBD, se poate dezactiva executarea scripturilor Lua, bloc\u00e2nd comenzile EVAL \u0219i EVALSHA prin ACL.    <\/p>\n<p>\u00cen plus, se pot men\u021biona \u00eenc\u0103 trei vulnerabilit\u0103\u021bi exploatate prin scripturi Lua \u0219i remediate \u00een cele mai recente versiuni Redis \u0219i Valkey. Pentru a oferi o protec\u021bie alternativ\u0103 \u00eempotriva acestor vulnerabilit\u0103\u021bi prin ACL, se pot interzice familiile de comenzi EVAL \u0219i FUNCTION.    <\/p>\n<ul>\n<li class=\"l\"> CVE-2025-46817 \u2014 o dep\u0103\u0219ire de tip \u00eentreg \u00een func\u021biile bibliotecii Lua, care permite poten\u021bial executarea de cod personalizat pe partea serverului. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/ro\/server\/dts-los-angeles\/\"   title=\"server\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"3984\">server<\/a> la executarea scripturilor Lua special concepute.\n<li class=\"l\"> CVE-2025-46819 \u2014 o eroare care duce la citirea datelor din afara tamponului \u00een timpul execu\u021biei unui script Lua special conceput. Vulnerabilitatea poate fi folosit\u0103 pentru a \u00eentrerupe procesul serverului Redis.\n<li class=\"l\"> CVE-2025-46818 \u2014 posibilitatea de a executa comenzi \u00een contextul altui utilizator al SGBD-ului prin manipularea obiectelor LUA dintr-un script Lua special conceput.        <\/ul>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=64022\">opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Wiz \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432 \u0421\u0423\u0411\u0414 Redis \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-49844), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 (RCE) \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043d\u0430\u0438\u0432\u044b\u0441\u0448\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (CVSS score 10 \u0438\u0437 10), \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0434\u043e\u043b\u0436\u0435\u043d \u0438\u043c\u0435\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043a \u0421\u0423\u0411\u0414 Redis, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0435\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 Lua-\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432. \u041f\u043e\u043c\u0438\u043c\u043e \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u043e\u0432 Redis, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0445 \u0434\u043e\u0441\u0442\u0443\u043f \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-144522","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Wiz \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432 \u0421\u0423\u0411\u0414 Redis \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-49844), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 (RCE) \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-redis-i-valkey-pozvolyayushhie-vypolnit-kod-na-servere-pri-nalichii-dostupa-k-bd\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Redis \u0438 Valkey, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0411\u0414 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Wiz \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432 \u0421\u0423\u0411\u0414 Redis \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-49844), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 (RCE) \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-redis-i-valkey-pozvolyayushhie-vypolnit-kod-na-servere-pri-nalichii-dostupa-k-bd\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-10-09T09:12:23+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2025-10-09T09:12:23+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u0103\u021bi \u00een Redis \u0219i Valkey, permit\u00e2nd executarea codului pe server \u00een condi\u021bii de acces la baza de date | ProHoster","description":"Cercet\u0103torii de la compania Wiz au identificat o vulnerabilitate \u00een SGBD-ul Redis (CVE-2025-49844), care permite ob\u021binerea execut\u0103rii de cod de la distan\u021b\u0103 (RCE) pe server.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-redis-i-valkey-pozvolyayushhie-vypolnit-kod-na-servere-pri-nalichii-dostupa-k-bd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Redis \u0438 Valkey, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0411\u0414 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Wiz \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432 \u0421\u0423\u0411\u0414 Redis \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-49844), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 (RCE) \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-redis-i-valkey-pozvolyayushhie-vypolnit-kod-na-servere-pri-nalichii-dostupa-k-bd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-10-09T09:12:23+00:00","article:modified_time":"2025-10-09T09:12:23+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"144522","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 15:54:02","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 15:14:19","updated":"2026-02-22 15:54:02","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/144522","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=144522"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/144522\/revisions"}],"predecessor-version":[{"id":162513,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/144522\/revisions\/162513"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=144522"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=144522"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=144522"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}