Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. The problem is fixed in versions 7.0.12, 6.2.13, and 6.0.20.
References
Link | Resource |
---|---|
https://github.com/redis/redis/security/advisories/GHSA-p8x2-9v9q-c838 | Vendor Advisory |
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MIF5MAGYARYUMRFK7PQI7HYXMK2HZE5T/ | Mailing List Third Party Advisory |
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TDNNH2ONMVNBQ6LUIAOAGDNFPKXNST5K/ | Mailing List Third Party Advisory |
https://security.netapp.com/advisory/ntap-20230814-0006/ |
Configurations
History
14 Aug 2023, 19:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
25 Jul 2023, 18:56
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* |
|
First Time |
Redis redis
Fedoraproject fedora Redis Fedoraproject |
|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
References | (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TDNNH2ONMVNBQ6LUIAOAGDNFPKXNST5K/ - Mailing List, Third Party Advisory | |
References | (MISC) https://github.com/redis/redis/security/advisories/GHSA-p8x2-9v9q-c838 - Vendor Advisory | |
References | (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MIF5MAGYARYUMRFK7PQI7HYXMK2HZE5T/ - Mailing List, Third Party Advisory |
19 Jul 2023, 06:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
13 Jul 2023, 15:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-07-13 15:15
Updated : 2024-02-28 20:33
NVD link : CVE-2022-24834
Mitre link : CVE-2022-24834
CVE.ORG link : CVE-2022-24834
JSON object : View
Products Affected
redis
- redis
fedoraproject
- fedora