Yii 2 Redis Extension AUTH Parameter Logging Vulnerability

A vulnerability exists in the Yii 2 Redis extension for the Yii framework 2.0, affecting versions prior to 2.0.20. When a connection fails, the extension logs the sequence of commands, including AUTH parameters, which are recorded in plain text. This exposure of usernames and passwords could be problematic if an attacker gains access to the logs.

Impact

The vulnerability allows for the exposure of AUTH parameters, including usernames and passwords, in the logs. This could lead to unauthorized access if the logged credentials are compromised.

Remediation

Users can upgrade to Yii 2 Redis extension version 2.0.20 or later to address this vulnerability.