Skip to content
OpenAdvisories
High ALAS2023-2023-291 1 CVE

Important: redis6 security update (Amazon Linux 2023)

Published Aug 3, 2023 · Updated Aug 9, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-24834: A heap-based buffer overflow flaw was found in Redis. This flaw allows an attacker to trick an authenticated user into executing a specially crafted Lua script in Redis. This attack triggers a heap overflow in the cjson and cmsgpack libraries, resulting in heap corruption and potential remote code execution.

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2023 redis6 0:6.2.13-1.amzn2023.0.1
Amazon Linux · 2023 redis6-debuginfo 0:6.2.13-1.amzn2023.0.1
Amazon Linux · 2023 redis6-debugsource 0:6.2.13-1.amzn2023.0.1
Amazon Linux · 2023 redis6-devel 0:6.2.13-1.amzn2023.0.1
Amazon Linux · 2023 redis6-doc 0:6.2.13-1.amzn2023.0.1

Vulnerabilities 1

  • High 7.0
    CVE-2022-24834 Public exploit EPSS 41%

    Heap overflow issue with the Lua cjson library used by Redis

    Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-24834.html