REDHAT-BUG-2317058: Medium severity Redis redis vulnerability
Redis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as KEYS, SCAN, PSUBSCRIBE, FUNCTION LIST, COMMAND LIST and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crash. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2317058?
REDHAT-BUG-2317058 is classified as a denial-of-service vulnerability due to its impact on system availability.
How do I fix REDHAT-BUG-2317058?
To fix REDHAT-BUG-2317058, upgrade Redis to a version later than 6.2.16, 7.2.6, or 7.4.1.
What commands are affected by REDHAT-BUG-2317058?
The commands affected by REDHAT-BUG-2317058 include KEYS, SCAN, PSUBSCRIBE, FUNCTION LIST, COMMAND LIST, and ACL definitions.
Who is affected by REDHAT-BUG-2317058?
Authenticated users of Redis versions 6.2.16 and earlier, 7.2.6 and earlier, and 7.4.1 and earlier are affected by REDHAT-BUG-2317058.
What type of vulnerability is REDHAT-BUG-2317058?
REDHAT-BUG-2317058 is a denial-of-service vulnerability that can be exploited using specially crafted strings.