CVE-2022-24736
Low
Description
Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. The problem is fixed in Redis versions 7.0.0 and 6.2.7. An additional workaround to mitigate this problem without patching the redis-server executable, if Lua scripting is not being used, is to block access to `SCRIPT LOAD` and `EVAL` commands using ACL rules.
SeverityLow
CVSS3.3
Exploit probability—
Product
Redis
PublishedApr 27, 2022
First seenApr 27, 2022
Weakness typeCWE-476NULL pointer dereference
How to fix
Update
- redis redis6.2.7 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VPYKSG7LKUJGVM2P72EHXKVRVRWHLORX/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WSTPUCAPBRHIFPSCOURR4OYX4E2OISAF/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J4ZK3675DGHVVDOFLJN7WX6YYH27GPMK/
- security.gentoo.org/glsa/202209-17
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redis redis | v < 6.2.7, 7.0 | 6.2.7 |
| fedoraproject fedora | 34, 35, 36 | — |
| netapp management_services_for_element_software | No range specified | — |
| netapp management_services_for_netapp_hci | No range specified | — |
| oracle communications_operations_monitor | 4.3, 4.4, 5.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.