Skip to content
OpenAdvisories
Medium ALSA-2024:10869 5 CVEs

Moderate: redis:7 security update

Published Dec 5, 2024 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.

Security Fix(es):

* redis: Redis SORT_RO may bypass ACL configuration (CVE-2023-41053)
* redis: possible bypass of Unix socket permissions on startup (CVE-2023-45145)
* redis: Denial-of-service due to malformed ACL selectors in Redis (CVE-2024-31227)
* redis: Lua library commands may lead to stack overflow and RCE in Redis (CVE-2024-31449)
* redis: Denial-of-service due to unbounded pattern matching in Redis (CVE-2024-31228)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 3

ReleasePackageFixed in
AlmaLinux · 9 redis 7.2.6-1.module_el9.5.0+130+36ae7635
AlmaLinux · 9 redis-devel 7.2.6-1.module_el9.5.0+130+36ae7635
AlmaLinux · 9 redis-doc 7.2.6-1.module_el9.5.0+130+36ae7635

Vulnerabilities 5

  • High 7.0
    CVE-2024-31449 Public exploit

    Lua library commands may lead to stack overflow and RCE in Redis

    Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in a…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • Medium 5.5
    CVE-2024-31228

    Denial-of-service due to unbounded pattern matching in Redis

    Redis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • Medium 4.4
    CVE-2024-31227

    Denial-of-service due to malformed ACL selectors in Redis

    Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem exists in Redis 7 pr…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • Low 3.6
    CVE-2023-45145

    Redis Unix-domain socket may have be exposed with the wrong permissions for a short time window.

    Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • Low 3.3
    CVE-2023-41053

    Redis SORT_RO may bypass ACL configuration

    Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by `SORT_RO` and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem e…

    Redis Redis redis redis Debian Alpine

References

  • report
    https://access.redhat.com/security/cve/CVE-2023-41053
  • report
    https://access.redhat.com/security/cve/CVE-2023-45145
  • report
    https://access.redhat.com/security/cve/CVE-2024-31227
  • report
    https://access.redhat.com/security/cve/CVE-2024-31228
  • report
    https://access.redhat.com/security/cve/CVE-2024-31449
  • report
    https://bugzilla.redhat.com/2237826
  • report
    https://bugzilla.redhat.com/2244940
  • report
    https://bugzilla.redhat.com/2317053
  • report
    https://bugzilla.redhat.com/2317056
  • report
    https://bugzilla.redhat.com/2317058
  • advisory
    https://errata.almalinux.org/9/ALSA-2024-10869.html