Skip to content
OpenAdvisories
High ALAS2023-2024-717 2 CVEs

Important: redis6 security update (Amazon Linux 2023)

Published Sep 26, 2024 · Updated Oct 2, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-31449: Lua library commands may be exploited by an authenticated user to achieve remote-code-execution CVE-2024-31228: Denial-of-service due to unbounded pattern matching

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2023 redis6 0:6.2.14-2.amzn2023.0.1
Amazon Linux · 2023 redis6-debuginfo 0:6.2.14-2.amzn2023.0.1
Amazon Linux · 2023 redis6-debugsource 0:6.2.14-2.amzn2023.0.1
Amazon Linux · 2023 redis6-devel 0:6.2.14-2.amzn2023.0.1
Amazon Linux · 2023 redis6-doc 0:6.2.14-2.amzn2023.0.1

Vulnerabilities 2

  • High 7.0
    CVE-2024-31449 Public exploit

    Lua library commands may lead to stack overflow and RCE in Redis

    Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in a…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • Medium 5.5
    CVE-2024-31228

    Denial-of-service due to unbounded pattern matching in Redis

    Redis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-31228.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-31449.html