BIT-VALKEY-2022-24735 Lua scripts can be manipulated to overcome ACL rules in Redis

🗓️ 22 Aug 2024 19:44:38Reported by GoogleType

osv🔗 osv.dev👁 27 Views

Redis is an in-memory database with a security vulnerability in Lua script execution environment, potentially allowing injection of code with higher privileges

Reporter	Title	Published	Views	Family All 114
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Redis affect IBM Event Streams (CVE-2022-24736, CVE-2022-24735)	30 Sep 202213:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Workspace is affected but not considered vulnerable to multiple vulnerabilities	26 Mar 202504:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Assistant App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	29 Jan 202520:13	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Redis affect IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift (CVE-2022-24736, CVE-2022-24735)	13 Dec 202215:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DataPower Gateway affected by vulnerabilities in Redis	29 Jul 202220:03	–	ibm
Tenable Nessus	Amazon Linux 2022 : redis6, redis6-devel (ALAS2022-2022-115)	6 Sep 202200:00	–	nessus
Tenable Nessus	Amazon Linux 2022 : redis6, redis6-devel (ALAS2022-2022-199)	5 Nov 202200:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : redis6, redis6-devel (ALAS2023-2023-064)	21 Mar 202300:00	–	nessus
Tenable Nessus	Amazon Linux 2 : redis (ALASREDIS6-2023-003)	27 Sep 202300:00	–	nessus
Tenable Nessus	AlmaLinux 8 : redis:6 (ALSA-2022:7541)	12 Nov 202200:00	–	nessus

Source	Link
github	www.github.com/redis/redis/pull/10651
github	www.github.com/redis/redis/releases/tag/6.2.7
github	www.github.com/redis/redis/releases/tag/7.0.0
github	www.github.com/redis/redis/security/advisories/GHSA-647m-2wmq-qmvq
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J4ZK3675DGHVVDOFLJN7WX6YYH27GPMK/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VPYKSG7LKUJGVM2P72EHXKVRVRWHLORX/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WSTPUCAPBRHIFPSCOURR4OYX4E2OISAF/
security	www.security.gentoo.org/glsa/202209-17
security	www.security.netapp.com/advisory/ntap-20220715-0003/
oracle	www.oracle.com/security-alerts/cpujul2022.html

14 Oct 2025 19:13Current

6.5Medium risk

Vulners AI Score6.5

CVSS 26.8

CVSS 3.13.9 - 7.8

EPSS0.02189

SSVC