REDHAT-BUG-2401292: Medium severity Redis redis vulnerability
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing LUA scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2401292?
The severity of REDHAT-BUG-2401292 is high as it allows authenticated users to execute arbitrary code in the context of another user via manipulated Lua scripts.
How do I fix REDHAT-BUG-2401292?
To fix REDHAT-BUG-2401292, upgrade Redis to version 8.2.2 or later where the vulnerability has been addressed.
Who is affected by REDHAT-BUG-2401292?
All authenticated users of Redis versions 8.2.1 and below are affected by REDHAT-BUG-2401292.
What type of vulnerability is REDHAT-BUG-2401292?
REDHAT-BUG-2401292 is a code execution vulnerability due to improperly handled Lua scripts in Redis.
What versions of Redis are vulnerable to REDHAT-BUG-2401292?
Redis versions 8.2.1 and below are vulnerable to REDHAT-BUG-2401292.