Lucene search

PRIOn knowledge basePRION:CVE-2022-24834

HistoryJul 13, 2023 - 3:15 p.m.

Null pointer dereference

2023-07-1315:15:00

PRIOn knowledge base

www.prio-n.com

redis

heap overflow

cjson library

lua scripting

remote code execution

security vulnerability

8.7 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

70.8%

JSON

Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. The problem is fixed in versions 7.0.12, 6.2.13, and 6.0.20.

CPENameOperatorVersion
fedoraeq37
fedoraeq38
redisge7.0.0
redislt7.0.12
redisge6.2.0
redislt6.2.13
redisge2.6.0
redislt6.0.20

Name	Operator	Version
fedora	eq	37
fedora	eq	38
redis	ge	7.0.0
redis	lt	7.0.12
redis	ge	6.2.0
redis	lt	6.2.13
redis	ge	2.6.0
redis	lt	6.0.20

References

github.com/redis/redis/security/advisories/GHSA-p8x2-9v9q-c838

lists.fedoraproject.org/archives/list/[email protected]/message/MIF5MAGYARYUMRFK7PQI7HYXMK2HZE5T/

lists.fedoraproject.org/archives/list/[email protected]/message/TDNNH2ONMVNBQ6LUIAOAGDNFPKXNST5K/

security.netapp.com/advisory/ntap-20230814-0006/