CVE-2022-24736

Name
CVE-2022-24736
Description
Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. The problem is fixed in Redis versions 7.0.0 and 6.2.7. An additional workaround to mitigate this problem without patching the redis-server executable, if Lua scripting is not being used, is to block access to `SCRIPT LOAD` and `EVAL` commands using ACL rules.
NVD Severity
medium
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://github.com/redis/redis/pull/10651
CONFIRM https://github.com/redis/redis/security/advisories/GHSA-3qpw-7686-5984
MISC https://github.com/redis/redis/releases/tag/7.0.0
MISC https://github.com/redis/redis/releases/tag/6.2.7
Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VPYKSG7LKUJGVM2P72EHXKVRVRWHLORX/
Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J4ZK3675DGHVVDOFLJN7WX6YYH27GPMK/
Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSTPUCAPBRHIFPSCOURR4OYX4E2OISAF/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:redis:redis:7.0:rc2:*:*:*:*:*:* redis == None == 7.0
cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:* redis >= None < 6.2.7

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
redis 3.15-main 6.2.7-r0 TBK <alpine@jjtc.eu> fixed
redis 3.14-main 6.2.7-r0 TBK <alpine@jjtc.eu> fixed
redis 3.13-main 6.0.16-r0 TBK <alpine@jjtc.eu> possibly vulnerable
redis 3.12-main 5.0.14-r0 TBK <alpine@jjtc.eu> possibly vulnerable