Skip to content
OpenAdvisories
Low ALSA-2022:7541 2 CVEs

Low: redis:6 security, bug fix, and enhancement update

Published Nov 8, 2022 · Updated Nov 3, 2026

Ecosystem: AlmaLinux

Summary

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.

The following packages have been upgraded to a later upstream version: redis (6.2.7). (BZ#1999873)

Security Fix(es):

* redis: Code injection via Lua script execution environment (CVE-2022-24735)
* redis: Malformed Lua script can crash Redis (CVE-2022-24736)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Fixed packages 3

ReleasePackageFixed in
AlmaLinux · 8 redis 6.2.7-1.module_el8.7.0+3288+a82c1b48
AlmaLinux · 8 redis-devel 6.2.7-1.module_el8.7.0+3288+a82c1b48
AlmaLinux · 8 redis-doc 6.2.7-1.module_el8.7.0+3288+a82c1b48

Vulnerabilities 2

  • Low 3.9
    CVE-2022-24735

    Lua scripts can be manipulated to overcome ACL rules in Redis

    Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis prior to version 7.0.0 or 6.2.7 can inject Lua code that will execute with the (potentially higher) privil…

    Redis Redis redis redis Debian Azure Linux Alpine
  • Low 3.3
    CVE-2022-24736

    A Malformed Lua script can crash Redis

    Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. The problem i…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine

References

  • report
    https://access.redhat.com/security/cve/CVE-2022-24735
  • report
    https://access.redhat.com/security/cve/CVE-2022-24736
  • report
    https://bugzilla.redhat.com/1999873
  • report
    https://bugzilla.redhat.com/2080286
  • report
    https://bugzilla.redhat.com/2080289
  • advisory
    https://errata.almalinux.org/8/ALSA-2022-7541.html