REDHAT-BUG-2376858: High severity Redis redis vulnerability
Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. The bug likely affects all Redis versions with hyperloglog operations implemented. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing hyperloglog operations. This can be done using ACL to restrict HLL commands.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2376858?
REDHAT-BUG-2376858 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix REDHAT-BUG-2376858?
To fix REDHAT-BUG-2376858, upgrade your Redis installation to version 8.0.3 or a later version.
What versions of Redis are affected by REDHAT-BUG-2376858?
REDHAT-BUG-2376858 affects Redis versions from 2.8 to before 8.0.3, including specific versions 7.4.5, 7.2.10, and 6.2.19.
What kind of exploit can REDHAT-BUG-2376858 lead to?
REDHAT-BUG-2376858 can lead to remote code execution due to an authenticated user's ability to trigger a stack/heap out of bounds write.
Is authentication required to exploit REDHAT-BUG-2376858?
Yes, an authenticated user is required to exploit REDHAT-BUG-2376858.