CVE-2024-46981 — Redis' Lua library commands may lead to remote code execution

Affected: redis

Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

USN-7321-1 — redis vulnerabilities

Affected: Ubuntu:Pro:14.04:LTS: redis, Ubuntu:Pro:16.04:LTS: redis, Ubuntu:Pro:18.04:LTS: redis, Ubuntu:Pro:20.04:LTS: redis, Ubuntu:Pro:22.04:LTS: redis, Ubuntu:24.04:LTS: redis

It was discovered that Redis incorrectly handled certain memory operations during pattern matching. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-31228)

It was discovered that Redis incorrectly handled certain specially crafted Lua scripts. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2024-46981)

It was discovered that Redis incorrectly handled some malformed ACL selectors. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.10 and Ubuntu 24.04 LTS. (CVE-2024-51741)

Most recent entries from all

CVE-2024-46981 — Redis' Lua library commands may lead to remote code execution

USN-7321-1 — redis vulnerabilities