Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. The problem is fixed in versions 7.0.12, 6.2.13, and 6.0.20.
References
Configurations
History
21 Nov 2024, 06:51
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.0 |
| References | () https://github.com/redis/redis/security/advisories/GHSA-p8x2-9v9q-c838 - Vendor Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MIF5MAGYARYUMRFK7PQI7HYXMK2HZE5T/ - Mailing List, Third Party Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TDNNH2ONMVNBQ6LUIAOAGDNFPKXNST5K/ - Mailing List, Third Party Advisory | |
| References | () https://security.netapp.com/advisory/ntap-20230814-0006/ - |
14 Aug 2023, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
25 Jul 2023, 18:56
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Redis redis
Fedoraproject fedora Redis Fedoraproject |
|
| References | (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TDNNH2ONMVNBQ6LUIAOAGDNFPKXNST5K/ - Mailing List, Third Party Advisory | |
| References | (MISC) https://github.com/redis/redis/security/advisories/GHSA-p8x2-9v9q-c838 - Vendor Advisory | |
| References | (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MIF5MAGYARYUMRFK7PQI7HYXMK2HZE5T/ - Mailing List, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| CPE | cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* |
19 Jul 2023, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
13 Jul 2023, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-07-13 15:15
Updated : 2024-11-21 06:51
NVD link : CVE-2022-24834
Mitre link : CVE-2022-24834
CVE.ORG link : CVE-2022-24834
JSON object : View
Products Affected
fedoraproject
- fedora
redis
- redis