Most recent entries from all

ALSA-2025:0595 — Important: redis:6 security update

Affected: AlmaLinux:8: redis, AlmaLinux:8: redis-devel, AlmaLinux:8: redis-doc

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.

Security Fix(es):

* redis: Integer overflow in the Redis HRANDFIELD and ZRANDMEMBER commands may lead to denial-of-service (CVE-2023-22458) * redis: Integer overflow in the Redis SETRANGE and SORT/SORT_RO commands may result with false OOM panic (CVE-2022-35977) * redis: Specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD commands can trigger an integer overflow (CVE-2022-36021) * redis: String matching commands (like SCAN or KEYS) with a specially crafted pattern to trigger a denial-of-service attack (CVE-2023-25155) * redis: Insufficient validation of HINCRBYFLOAT command (CVE-2023-28856) * redis: heap overflow in the lua cjson and cmsgpack libraries (CVE-2022-24834) * redis: possible bypass of Unix socket permissions on startup (CVE-2023-45145) * redis: Lua library commands may lead to stack overflow and RCE in Redis (CVE-2024-31449) * redis: Denial-of-service due to unbounded pattern matching in Redis (CVE-2024-31228) * redis: Redis' Lua library commands may lead to remote code execution (CVE-2024-46981)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and o…

bdu:2023-07213

BELL-CVE-2022-24834

Affected: Alpaquita:23: redis

BIT-keydb-2022-24834 — Heap overflow issue with the Lua cjson library used by Redis

Affected: Bitnami: keydb

Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. The problem is fixed in versions 7.0.12, 6.2.13, and 6.0.20.

certfr-2024-avi-0119 — De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entr…

certfr-2024-avi-0119

Withdrawn: CLEANSTART-2026-AF35851 — Redis is an open source, in-memory database that persists on disk

Withdrawn by the publisher.

Affected: CleanStart: redis

Multiple security vulnerabilities affect the redis package. Redis is an open source, in-memory database that persists on disk. See references for individual vulnerability details.

EUVD-2026-216015

fkie_cve-2022-24834

gsd-2022-24834

ICSA-24-046-11 — Siemens SCALANCE XCM-/XRM-300

A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash.

This issue affects Apache HTTP Server 2.4.54 and earlier. A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability. A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. This flaw allows an attacker to achieve code execution if they can alter the header information of an RPM package and then trick a user or system into installing it. The highest risk of this vulnerability is to confidentiality, integrity, as well as system availability. An out-of-bounds memory access flaw was found in the ATI VGA device emulation of QEMU. This flaw occurs in the ati_2d_blt() routine while handling MMIO write operations when the guest provides invalid values for the destination display parameters. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service. A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create…

msrc_CVE-2022-24834 — Heap overflow issue with the Lua cjson library used by Redis

msrc_CVE-2022-24834

OESA-2023-1458 — redis security update

Affected: openEuler:20.03-LTS-SP1: redis, openEuler:20.03-LTS-SP3: redis, openEuler:22.03-LTS: redis, openEuler:22.03-LTS-SP1: redis, openEuler:22.03-LTS-SP2: redis

Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes,lists, sets anorted sets. Security Fix(es): Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. The problem is fixed in versions 7.0.12, 6.2.13, and 6.0.20.(CVE-2022-24834)

openSUSE-SU-2024:13047-1 — redis-7.0.12-1.1 on GA media

redis-7.0.12-1.1 on GA media

SUSE-SU-2023:2925-1 — Security update for redis7

Security update for redis7

UBUNTU-CVE-2022-24834

Affected: Ubuntu:Pro:14.04:LTS: redis, Ubuntu:Pro:16.04:LTS: redis, Ubuntu:16.04:LTS: lua-cjson, Ubuntu:18.04:LTS: lua-cjson, Ubuntu:Pro:18.04:LTS: redis, Ubuntu:Pro:20.04:LTS: lua-cjson, Ubuntu:Pro:20.04:LTS: redis, Ubuntu:Pro:22.04:LTS: lua-cjson, Ubuntu:Pro:22.04:LTS: redis, Ubuntu:24.04:LTS: lua-cjson and 4 more

WID-SEC-W-2023-1698 — Redis: Mehrere Schwachstellen ermöglichen Codeausführung

Ein lokaler Angreifer kann mehrere Schwachstellen in Redis ausnutzen, um beliebigen Programmcode auszuführen.