Security Bulletin: Vulnerabilities in Redis affect IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift (CVE-2022-24736, CVE-2022-24735)

Summary

Vulnerabilities in Redis, such as denial of service and execution of arbitrary code on the system, may affect IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift.

Vulnerability Details

CVEID:CVE-2022-24736
**DESCRIPTION:**Redis is vulnerable to a denial of service, caused by a NULL pointer dereference. By loading a specially crafted Lua script, a local authenticated attacker could exploit this vulnerability to cause a crash of the redis-server process.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/225345 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2022-24735
**DESCRIPTION:**Redis could allow a local authenticated attacker to execute arbitrary code on the system, caused by improper validation of user-supplied input by the Lua script execution environment. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code with the potentially higher privileges of another Redis user on the system.
CVSS Base score: 3.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/225346 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N)

Affected Products and Versions

Remediation/Fixes

IBM Spectrum Protect Plus Affected Versions|Fixing Level|Platform|**Link to Fix and Instructions
**
—|—|—|—
10.1.5-10.1.12 (Kubernetes)
10.1.7-10.1.12 (Red Hat OpenShift)| 10.1.12.3| Linux| <https://www.ibm.com/support/pages/node/6603663&gt;

Workarounds and Mitigations

None