REDHAT-BUG-2401322: Medium severity Redis redis vulnerability
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2401322?
The severity of REDHAT-BUG-2401322 is classified as high due to the potential for denial of service and data exposure.
How do I fix REDHAT-BUG-2401322?
To fix REDHAT-BUG-2401322, upgrade Redis to version 8.2.2 or later, where the vulnerability has been addressed.
What impact does REDHAT-BUG-2401322 have on Redis users?
REDHAT-BUG-2401322 allows authenticated users to execute malicious LUA scripts that can lead to server crashes or data leaks.
Are all versions of Redis affected by REDHAT-BUG-2401322?
Yes, all versions of Redis up to and including 8.2.1 are affected by REDHAT-BUG-2401322.
Who is at risk from REDHAT-BUG-2401322?
Any organization using an affected version of Redis for their applications is at risk from the vulnerabilities detailed in REDHAT-BUG-2401322.