Summary
Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.
Security Fix(es):
* redis: Redis' Lua library commands may lead to remote code execution (CVE-2024-46981)
* redis: Redis allows denial-of-service due to malformed ACL selectors (CVE-2024-51741)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | redis | 7.2.7-1.module_el9.5.0+134+2e645600 |
| AlmaLinux · 9 | redis-devel | 7.2.7-1.module_el9.5.0+134+2e645600 |
| AlmaLinux · 9 | redis-doc | 7.2.7-1.module_el9.5.0+134+2e645600 |
Vulnerabilities 2
-
High 7.0CVE-2024-46981 Public exploit
Redis' Lua library commands may lead to remote code execution
Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17…
-
Medium 4.4
Redis allows denial-of-service due to malformed ACL selectors
Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem is fixed in Redis 7.…