REDHAT-BUG-2317058
First published: Mon Oct 07 2024(Updated: )
Redis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST` and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crash. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ioredis | <6.2.16<7.2.6<7.4.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of REDHAT-BUG-2317058?
REDHAT-BUG-2317058 is classified as a denial-of-service vulnerability due to its impact on system availability.
How do I fix REDHAT-BUG-2317058?
To fix REDHAT-BUG-2317058, upgrade Redis to a version later than 6.2.16, 7.2.6, or 7.4.1.
What commands are affected by REDHAT-BUG-2317058?
The commands affected by REDHAT-BUG-2317058 include KEYS, SCAN, PSUBSCRIBE, FUNCTION LIST, COMMAND LIST, and ACL definitions.
Who is affected by REDHAT-BUG-2317058?
Authenticated users of Redis versions 6.2.16 and earlier, 7.2.6 and earlier, and 7.4.1 and earlier are affected by REDHAT-BUG-2317058.
What type of vulnerability is REDHAT-BUG-2317058?
REDHAT-BUG-2317058 is a denial-of-service vulnerability that can be exploited using specially crafted strings.
- agent/severity
- agent/description
- agent/type
- agent/first-publish-date
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-31228
- agent/references
- agent/last-modified-date
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/redis
- canonical/ioredis