REDHAT-BUG-2336004: High severity Redis redis vulnerability
Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.4.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.2.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.2.17 - Configuration
Use Redis ACLs to restrict (deny) the EVAL and EVALSHA commands so authenticated users cannot execute Lua scripts.
Redis ACL command category restrictions = deny EVAL and EVALSHA
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2336004?
The severity of REDHAT-BUG-2336004 is critical due to the potential for remote code execution.
How do I fix REDHAT-BUG-2336004?
To fix REDHAT-BUG-2336004, upgrade to Redis versions 7.4.2, 7.2.7, or 6.2.17.
What causes REDHAT-BUG-2336004?
REDHAT-BUG-2336004 is caused by an authenticated user exploiting a specially crafted Lua script to manipulate the garbage collector.
Who is affected by REDHAT-BUG-2336004?
Any organization using vulnerable versions of Redis is affected by REDHAT-BUG-2336004.
Is there a workaround for REDHAT-BUG-2336004?
Yes, there is a workaround available to mitigate the risks associated with REDHAT-BUG-2336004 before upgrading.