Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. The problem is fixed in versions 7.0.12, 6.2.13, and 6.0.20.
References
Link | Resource |
---|---|
https://github.com/redis/redis/security/advisories/GHSA-p8x2-9v9q-c838 | Vendor Advisory |
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MIF5MAGYARYUMRFK7PQI7HYXMK2HZE5T/ | Mailing List Third Party Advisory |
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TDNNH2ONMVNBQ6LUIAOAGDNFPKXNST5K/ | Mailing List Third Party Advisory |
https://security.netapp.com/advisory/ntap-20230814-0006/ |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: GitHub_M
Published: 2023-07-13T14:35:41.181Z
Updated: 2023-07-13T14:35:41.181Z
Reserved: 2022-02-10T16:41:34.931Z
Link: CVE-2022-24834
JSON object: View
NVD Information
Status : Modified
Published: 2023-07-13T15:15:08.817
Modified: 2023-08-14T19:15:09.603
Link: CVE-2022-24834
JSON object: View
Redhat Information
No data.