REDHAT-BUG-2369153: Buffer Overflow
Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution. This issue has been patched in version 8.0.2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2369153?
REDHAT-BUG-2369153 is classified as a high severity vulnerability due to the potential for stack-based buffer overflow.
How do I fix REDHAT-BUG-2369153?
To fix REDHAT-BUG-2369153, upgrade Redis to version 8.0.2 or later where the vulnerability is patched.
What versions of Redis are affected by REDHAT-BUG-2369153?
REDHAT-BUG-2369153 affects Redis versions starting from 7.0.0 up to, but not including, 8.0.2.
What impact does REDHAT-BUG-2369153 have on Redis users?
The impact of REDHAT-BUG-2369153 may allow attackers to execute arbitrary code on systems running vulnerable versions of Redis.
Is there a workaround for REDHAT-BUG-2369153?
Currently, the best workaround for REDHAT-BUG-2369153 is to avoid using redis-check-aof until the software is updated.