Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. The problem is fixed in versions 7.0.12, 6.2.13, and 6.0.20.
References
Link | Resource |
---|---|
https://github.com/redis/redis/security/advisories/GHSA-p8x2-9v9q-c838 | Vendor Advisory |
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MIF5MAGYARYUMRFK7PQI7HYXMK2HZE5T/ | Mailing List Third Party Advisory |
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TDNNH2ONMVNBQ6LUIAOAGDNFPKXNST5K/ | Mailing List Third Party Advisory |
https://security.netapp.com/advisory/ntap-20230814-0006/ |
Configurations
History
14 Aug 2023, 19:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
25 Jul 2023, 18:56
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
References | (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MIF5MAGYARYUMRFK7PQI7HYXMK2HZE5T/ - Mailing List, Third Party Advisory | |
References | (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TDNNH2ONMVNBQ6LUIAOAGDNFPKXNST5K/ - Mailing List, Third Party Advisory | |
References | (MISC) https://github.com/redis/redis/security/advisories/GHSA-p8x2-9v9q-c838 - Vendor Advisory | |
CPE | cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* |
|
First Time |
Redis
Fedoraproject fedora Fedoraproject Redis redis |
19 Jul 2023, 06:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
13 Jul 2023, 15:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-07-13 15:15
Updated : 2023-12-10 15:14
NVD link : CVE-2022-24834
Mitre link : CVE-2022-24834
CVE.ORG link : CVE-2022-24834
JSON object : View
Products Affected
fedoraproject
- fedora
redis
- redis