CVE-2022-24735 Lua scripts can be manipulated to overcome ACL rules in Redis

🗓️ 27 Apr 2022 19:43:27Reported by GitHub_MType

Weakness in Lua script execution in Redis allowing ACL rule manipulation

Reporter	Title	Published	Views	Family All 114
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Redis affect IBM Event Streams (CVE-2022-24736, CVE-2022-24735)	30 Sep 202213:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Workspace is affected but not considered vulnerable to multiple vulnerabilities	26 Mar 202504:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Assistant App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	29 Jan 202520:13	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Redis affect IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift (CVE-2022-24736, CVE-2022-24735)	13 Dec 202215:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DataPower Gateway affected by vulnerabilities in Redis	29 Jul 202220:03	–	ibm
Tenable Nessus	Amazon Linux 2022 : redis6, redis6-devel (ALAS2022-2022-115)	6 Sep 202200:00	–	nessus
Tenable Nessus	Amazon Linux 2022 : redis6, redis6-devel (ALAS2022-2022-199)	5 Nov 202200:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : redis6, redis6-devel (ALAS2023-2023-064)	21 Mar 202300:00	–	nessus
Tenable Nessus	Amazon Linux 2 : redis (ALASREDIS6-2023-003)	27 Sep 202300:00	–	nessus
Tenable Nessus	AlmaLinux 8 : redis:6 (ALSA-2022:7541)	12 Nov 202200:00	–	nessus

[
  {
    "product": "redis",
    "vendor": "redis",
    "versions": [
      {
        "status": "affected",
        "version": "< 7.0.0"
      },
      {
        "status": "affected",
        "version": ">= 6.0.0, < 6.2.7"
      }
    ]
  }
]

Source	Link
github	www.github.com/redis/redis/releases/tag/7.0.0
security	www.security.gentoo.org/glsa/202209-17
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J4ZK3675DGHVVDOFLJN7WX6YYH27GPMK/
github	www.github.com/redis/redis/security/advisories/GHSA-647m-2wmq-qmvq
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VPYKSG7LKUJGVM2P72EHXKVRVRWHLORX/
github	www.github.com/redis/redis/pull/10651
github	www.github.com/redis/redis/releases/tag/6.2.7
oracle	www.oracle.com/security-alerts/cpujul2022.html
security	www.security.netapp.com/advisory/ntap-20220715-0003/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WSTPUCAPBRHIFPSCOURR4OYX4E2OISAF/

29 Sep 2022 16:07Current

8.1High risk

Vulners AI Score8.1

CVSS 3.13.9

EPSS0.0168

CWE-94