Most recent entries from all

ALSA-2025:0595 — Important: redis:6 security update

Affected: AlmaLinux:8: redis, AlmaLinux:8: redis-devel, AlmaLinux:8: redis-doc

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.

Security Fix(es):

* redis: Integer overflow in the Redis HRANDFIELD and ZRANDMEMBER commands may lead to denial-of-service (CVE-2023-22458) * redis: Integer overflow in the Redis SETRANGE and SORT/SORT_RO commands may result with false OOM panic (CVE-2022-35977) * redis: Specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD commands can trigger an integer overflow (CVE-2022-36021) * redis: String matching commands (like SCAN or KEYS) with a specially crafted pattern to trigger a denial-of-service attack (CVE-2023-25155) * redis: Insufficient validation of HINCRBYFLOAT command (CVE-2023-28856) * redis: heap overflow in the lua cjson and cmsgpack libraries (CVE-2022-24834) * redis: possible bypass of Unix socket permissions on startup (CVE-2023-45145) * redis: Lua library commands may lead to stack overflow and RCE in Redis (CVE-2024-31449) * redis: Denial-of-service due to unbounded pattern matching in Redis (CVE-2024-31228) * redis: Redis' Lua library commands may lead to remote code execution (CVE-2024-46981)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and o…

bdu:2023-00695

Withdrawn: BELL-CVE-2022-35977 — CVE-2022-35977 does not affect BellSoft software

Withdrawn by the publisher.

BIT-keydb-2022-35977 — Integer overflow in certain command arguments can drive Redis to OOM panic

Affected: Bitnami: keydb

Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SETRANGE` and `SORT(_RO)` commands can trigger an integer overflow, resulting with Redis attempting to allocate impossible amounts of memory and abort with an out-of-memory (OOM) panic. The problem is fixed in Redis versions 7.0.8, 6.2.9 and 6.0.17. Users are advised to upgrade. There are no known workarounds for this vulnerability.

certfr-2023-avi-0427 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre el…

certfr-2023-avi-0427

Withdrawn: CLEANSTART-2026-AF35851 — Redis is an open source, in-memory database that persists on disk

Withdrawn by the publisher.

Affected: CleanStart: redis

Multiple security vulnerabilities affect the redis package. Redis is an open source, in-memory database that persists on disk. See references for individual vulnerability details.

EUVD-2026-258352

fkie_cve-2022-35977

gsd-2022-35977

msrc_CVE-2022-35977 — Integer overflow in certain command arguments can drive Redis to OOM panic

msrc_CVE-2022-35977

OESA-2025-1157 — redis security update

Affected: openEuler:24.03-LTS-SP1: redis, openEuler:20.03-LTS-SP4: redis, openEuler:22.03-LTS-SP3: redis, openEuler:22.03-LTS-SP4: redis, openEuler:24.03-LTS: redis

Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets. Security Fix(es):

Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can cause the heap-based Lua stack to be overflowed, due to incomplete checks for this condition. This can result with heap corruption and potentially remote code execution. This problem exists in all versions of Redis with Lua scripting support, starting from 2.6. The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14. For users unable to update an additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.(CVE-2021-32626)

Redis is an open source, in-memory database that persists on disk. In affected versions an integer overflow bug in Redis can be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves changing the default proto-max-bulk-len and client-query-buffer-limit configuration parameters to very large values and constructing specially crafted very large stream elements. The problem is fixed in Redis 6.2.6, 6.0.16 and 5.0.14. For users unable to upgrade an additional workaround to mitigate the problem without patching the redis-server executable is to prevent user…

openSUSE-SU-2024:12619-1 — redis-7.0.8-1.1 on GA media

redis-7.0.8-1.1 on GA media

SUSE-SU-2023:0274-1 — Security update for redis

Security update for redis

UBUNTU-CVE-2022-35977

Affected: Ubuntu:Pro:14.04:LTS: redis, Ubuntu:Pro:16.04:LTS: redis, Ubuntu:Pro:18.04:LTS: redis, Ubuntu:Pro:20.04:LTS: redis, Ubuntu:Pro:22.04:LTS: redis

WID-SEC-W-2023-0102 — Redis: Mehrere Schwachstellen ermöglichen Denial of Service

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Redis ausnutzen, um einen Denial of Service Angriff durchzuführen.