Skip to content
OpenAdvisories
High RHSA-2024:10869 5 CVEs

Red Hat Security Advisory: redis:7 security update

Published Dec 7, 2024 · Updated Aug 7, 2026

Ecosystem: Red Hat

Fixed packages 5

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream redis 0:7.2.6-1.module+el9.5.0+22422+63e067d8
Red Hat · RHEL 9 enterprise_linux:9::appstream redis-debuginfo 0:7.2.6-1.module+el9.5.0+22422+63e067d8
Red Hat · RHEL 9 enterprise_linux:9::appstream redis-debugsource 0:7.2.6-1.module+el9.5.0+22422+63e067d8
Red Hat · RHEL 9 enterprise_linux:9::appstream redis-devel 0:7.2.6-1.module+el9.5.0+22422+63e067d8
Red Hat · RHEL 9 enterprise_linux:9::appstream redis-doc 0:7.2.6-1.module+el9.5.0+22422+63e067d8

Vulnerabilities 5

  • High 7.0
    CVE-2024-31449 Public exploit

    Lua library commands may lead to stack overflow and RCE in Redis

    Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in a…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • Medium 5.5
    CVE-2024-31228

    Denial-of-service due to unbounded pattern matching in Redis

    Redis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • Medium 4.4
    CVE-2024-31227

    Denial-of-service due to malformed ACL selectors in Redis

    Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem exists in Redis 7 pr…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • Low 3.6
    CVE-2023-45145

    Redis Unix-domain socket may have be exposed with the wrong permissions for a short time window.

    Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • Low 3.3
    CVE-2023-41053

    Redis SORT_RO may bypass ACL configuration

    Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by `SORT_RO` and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem e…

    Redis Redis redis redis Debian Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2237826
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2244940
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2317053
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2317056
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2317058
  • article
    https://issues.redhat.com/browse/RHEL-26628
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10869.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-41053
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-41053
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-41053
  • article
    https://github.com/redis/redis/commit/9e505e6cd842338424e05883521ca1fb7d0f47f6
  • article
    https://github.com/redis/redis/security/advisories/GHSA-q4jr-5p56-4xwc
  • report
    https://access.redhat.com/security/cve/CVE-2023-45145
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-45145
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-45145
  • article
    https://github.com/redis/redis/security/advisories/GHSA-ghmp-889m-7cvx
  • report
    https://access.redhat.com/security/cve/CVE-2024-31227
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-31227
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-31227
  • article
    https://github.com/redis/redis/commit/b351d5a3210e61cc3b22ba38a723d6da8f3c298a
  • article
    https://github.com/redis/redis/security/advisories/GHSA-38p4-26x2-vqhh
  • report
    https://access.redhat.com/security/cve/CVE-2024-31228
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-31228
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-31228
  • article
    https://github.com/redis/redis/commit/9317bf64659b33166a943ec03d5d9b954e86afb0
  • article
    https://github.com/redis/redis/security/advisories/GHSA-66gq-c942-6976
  • report
    https://access.redhat.com/security/cve/CVE-2024-31449
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-31449
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-31449
  • article
    https://github.com/redis/redis/commit/1f7c148be2cbacf7d50aa461c58b871e87cc5ed9
  • article
    https://github.com/redis/redis/security/advisories/GHSA-whxg-wx83-85p5