REDHAT-BUG-2336004
First published: Mon Jan 06 2025(Updated: )
Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ioredis | <7.4.2<7.2.7<6.2.17 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHSA-2025:0400
- https://access.redhat.com/errata/RHSA-2025:0398
- https://access.redhat.com/errata/RHSA-2025:0399
- https://access.redhat.com/errata/RHSA-2025:0566
- https://access.redhat.com/errata/RHSA-2025:0595
- https://access.redhat.com/errata/RHSA-2025:0640
- https://access.redhat.com/errata/RHSA-2025:0693
- https://access.redhat.com/errata/RHSA-2025:0689
- https://access.redhat.com/errata/RHSA-2025:0685
- https://access.redhat.com/errata/RHSA-2025:0692
- https://bugzilla.redhat.com/show_bug.cgi?id=2336004
Frequently Asked Questions
What is the severity of REDHAT-BUG-2336004?
The severity of REDHAT-BUG-2336004 is critical due to the potential for remote code execution.
How do I fix REDHAT-BUG-2336004?
To fix REDHAT-BUG-2336004, upgrade to Redis versions 7.4.2, 7.2.7, or 6.2.17.
What causes REDHAT-BUG-2336004?
REDHAT-BUG-2336004 is caused by an authenticated user exploiting a specially crafted Lua script to manipulate the garbage collector.
Who is affected by REDHAT-BUG-2336004?
Any organization using vulnerable versions of Redis is affected by REDHAT-BUG-2336004.
Is there a workaround for REDHAT-BUG-2336004?
Yes, there is a workaround available to mitigate the risks associated with REDHAT-BUG-2336004 before upgrading.
- agent/severity
- agent/type
- agent/first-publish-date
- agent/description
- agent/event
- agent/source
- agent/softwarecombine
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-46981
- agent/last-modified-date
- agent/references
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/redis
- canonical/ioredis