CVEvulnerability

CVE-2022-24834

8.8 HIGH Published 2023-07-13 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-07-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.0 HIGH — CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-122, CWE-680

Description

Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. The problem is fixed in versions 7.0.12, 6.2.13, and 6.0.20.

Affected configurations

• redis redis (>= 2.6.0 < 6.0.20) • redis redis (>= 6.2.0 < 6.2.13) • redis redis (>= 7.0.0 < 7.0.12) • fedoraproject fedora 37 • fedoraproject fedora 38

Related

Weakness · CWE (2)

  • CWE-122 Heap-based Buffer Overflow weakness
  • CWE-680 Integer Overflow to Buffer Overflow weakness

References