Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-24736: A flaw was found in the Redis database when a malformed Lua script can cause a NULL pointer dereference. This flaw allows an attacker to load a crafting script, which results in a crash of the redis-server process. CVE-2022-24735: A flaw was found in the Redis database where Lua scripts can be manipulated to overcome ACL rules. This flaw allows an attacker with access to Redis to inject Lua code that executes the potentially higher privileges of another Redis user.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | redis6 | 0:6.2.7-1.amzn2023.0.3 |
| Amazon Linux · 2023 | redis6-debuginfo | 0:6.2.7-1.amzn2023.0.3 |
| Amazon Linux · 2023 | redis6-debugsource | 0:6.2.7-1.amzn2023.0.3 |
| Amazon Linux · 2023 | redis6-devel | 0:6.2.7-1.amzn2023.0.3 |
| Amazon Linux · 2023 | redis6-doc | 0:6.2.7-1.amzn2023.0.3 |
Vulnerabilities 2
-
Low 3.9
Lua scripts can be manipulated to overcome ACL rules in Redis
Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis prior to version 7.0.0 or 6.2.7 can inject Lua code that will execute with the (potentially higher) privil…
-
Low 3.3
A Malformed Lua script can crash Redis
Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. The problem i…