Advisory ROSA-SA-2023-2296

software: redis 7.0.12
OS: ROSA-CHROME

package_evr_string: redis-7.0.12-1.src.rpm

CVE-ID: CVE-2022-24834
BDU-ID: 2023-07213
CVE-Crit: HIGH
CVE-DESC.: A vulnerability in the cjson and cmsgpack libraries of the Redis database management system (DBMS) is related to a buffer overflow in dynamic memory. Exploitation of the vulnerability could allow an attacker to execute arbitrary code using a specially crafted Lua script
CVE-STATUS: Fixed
CVE-REV: To close, run the command: sudo dnf update redis

CVE-ID: CVE-2022-31144
BDU-ID: 2022-04601
CVE-Crit: HIGH
CVE-DESC.: A vulnerability in the Redis database management system (DBMS) is related to a heap buffer overflow. Exploitation of the vulnerability could allow an attacker to execute arbitrary code using the XAUTOCLAIM command
CVE-STATUS: Fixed
CVE-REV: To close, run the command: sudo dnf update redis

CVE-ID: CVE-2022-35951
BDU-ID: 2022-05912
CVE-Crit: HIGH
CVE-DESC.: A vulnerability in the Redis database management system (DBMS) implementation of the XAUTOCLAIM command is related to an integer overflow when processing the COUNT argument. Exploitation of the vulnerability could allow an attacker to execute arbitrary code
CVE-STATUS: Fixed
CVE-REV: To close, run the command: sudo dnf update redis

CVE-ID: CVE-2023-36824
BDU-ID: 2023-04264
CVE-Crit: HIGH
CVE-DESC.: A vulnerability in the Redis database management system (DBMS) is related to a buffer overflow. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code
CVE-STATUS: Fixed
CVE-REV: To close, run the command: sudo dnf update redis