Deserialization of Untrusted Data in redisson - CVE-2023-42809
Published: April 28, 2025
Vulnerability identifier: #VU107989
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-42809
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to some of the messages received from the Redis server contain Java objects that the client deserializes without further validation. A remote attacker can manage to trick clients into communicating with a malicious server to include especially crafted objects in its responses that, once deserialized by the client, force it to execute arbitrary code. This can be abused to take control of the machine the client is running in.
Affected software
redisson
Cloud Pak for Network Automation
Voice Gateway
IBM Watson Knowledge Catalog in Cloud Pak for Data
Cloud Pak for Network Automation
Voice Gateway
IBM Watson Knowledge Catalog in Cloud Pak for Data
How to mitigate CVE-2023-42809
Install updates from vendor's website.
redisson - update to 3.22.0
Voice Gateway - update to 1.0.8.8
Cloud Pak for Network Automation - update to 2.7.6
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.9, 5.1.3
Voice Gateway - update to 1.0.8.8
Cloud Pak for Network Automation - update to 2.7.6
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.9, 5.1.3