REDHAT-BUG-2442025: High severity Valkey Valkey vulnerability
Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same connection. The error handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Valkeyto a version that resolves this vulnerability.Fixed in 9.0.2 - Upgrade
Upgrade
Valkeyto a version that resolves this vulnerability.Fixed in 8.1.6 - Upgrade
Upgrade
Valkeyto a version that resolves this vulnerability.Fixed in 8.0.7 - Upgrade
Upgrade
Valkeyto a version that resolves this vulnerability.Fixed in 7.2.12
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2442025?
The severity of REDHAT-BUG-2442025 is considered high due to the potential for data corruption and unauthorized manipulation by malicious users.
How do I fix REDHAT-BUG-2442025?
To fix REDHAT-BUG-2442025, upgrade to the latest versions of Valkey which are 9.0.2 or later, 8.1.6 or later, 8.0.7 or later, and 7.2.12 or later.
What versions of Valkey are affected by REDHAT-BUG-2442025?
Valkey versions prior to 9.0.2, 8.1.6, 8.0.7, and 7.2.12 are affected by REDHAT-BUG-2442025.
Can REDHAT-BUG-2442025 affect multiple users?
Yes, REDHAT-BUG-2442025 can affect multiple users by potentially returning tampered data to clients on the same connection.
What type of attack is associated with REDHAT-BUG-2442025?
REDHAT-BUG-2442025 is associated with arbitrary information injection through scripting commands, leading to data integrity issues.