CVE-2022-24736: A Malformed Lua script can crash Redis
A Malformed Lua script can crash Redis
Other sources
Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. The problem is fixed in Redis versions 7.0.0 and 6.2.7. An additional workaround to mitigate this problem without patching the redis-server executable, if Lua scripting is not being used, is to block access to SCRIPT LOAD and EVAL commands using ACL rules.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-24736?
CVE-2022-24736 is a vulnerability in Redis versions prior to 6.2.7 and 7.0.0 that allows an attacker to crash the redis-server process by loading a specially crafted Lua script.
How severe is CVE-2022-24736?
CVE-2022-24736 has a severity rating of 5.5 (medium).
How can I fix CVE-2022-24736?
To fix CVE-2022-24736, you must upgrade Redis to version 6.2.7 or 7.0.0.
What software is affected by CVE-2022-24736?
Redis versions prior to 6.2.7 and 7.0.0 are affected by CVE-2022-24736.
Where can I find more information about CVE-2022-24736?
You can find more information about CVE-2022-24736 in the following references: [Reference 1](https://github.com/redis/redis/pull/10651), [Reference 2](https://github.com/redis/redis/releases/tag/6.2.7), [Reference 3](https://github.com/redis/redis/releases/tag/7.0.0).