Oracle Linux 9 : redis:7 (ELSA-2024-10869)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-10869 advisory. 7.2.6-1 - rebase to 7.2.6 RHEL-26628 7.0.12-1 - rebase to 7.0.12 2221899 7.0.11-1 - rebase to 7.0.11 for new redis:7 stream 2129826 7.0.11-1 - Upstrea...

Moderate: Red Hat Security Advisory: redis:7 security update

An update for the redis:7 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

redis: Redis SORT_RO may bypass ACL configuration

Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by SORTRO and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been...

redis: Denial-of-service due to malformed ACL selectors in Redis

A flaw was found in Redis. This flaw allows an authenticated attacker with sufficient privileges to create a malformed ACL selector that triggers a server panic and subsequent denial of service when accessed...

redis: Lua library commands may lead to stack overflow and RCE in Redis

A flaw was found in Redis. This flaw allows an authenticated user to use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may lead to remote code execution. The problem exists in all versions of Redis with Lua scripting...

redis: possible bypass of Unix socket permissions on startup

A flaw was found in Redis, an in-memory database that persists on disk. On startup, Redis listens on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask2 is used, this creates a race condition that enables, during a short period of time, anothe...

redis: Denial-of-service due to unbounded pattern matching in Redis

A flaw was found in Redis. This flaw allows authenticated users to trigger a denial of service by using specially crafted, long string match patterns on supported commands such as KEYS, SCAN, PSUBSCRIBE, FUNCTION LIST, COMMAND LIST, and ACL definitions. Matching of extremely long patterns may...

Moderate: redis:7 security update

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, ...

ALSA-2024:10869 Moderate: redis:7 security update

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, ...

Withdrawn Advisory: Netty vulnerability included in redis lettuce

Withdrawn Advisory This advisory has been withdrawn because users of Lettuce may independently exclude vulnerable versions of Netty from their dependencies, and those users should not receive alerts for CVE-2024-47535. This link is maintained to preserve external references. Original Description...

GHSA-Q4H9-7RXJ-7GX2 Withdrawn Advisory: Netty vulnerability included in redis lettuce

Withdrawn Advisory This advisory has been withdrawn because users of Lettuce may independently exclude vulnerable versions of Netty from their dependencies, and those users should not receive alerts for CVE-2024-47535. This link is maintained to preserve external references. Original Description...

Debian: Security Advisory (DLA-3973-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 3973-1] redis security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3973-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk November 28, 2024 https://wiki.debian.org/LTS -...

Debian dla-3973 : redis - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3973 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3973-1 [email protected]...

DLA-3973-1 redis - security update

Bulletin has no description...

Binary Vulnerability in Damon New Cloud Cache Database of Wuhan Damon Database Co.

Damon New Cloud Cache Database DMCDM is a Key-Value database that is deeply compatible with the native Redis protocol. A binary vulnerability exists in the Damon New Cloud Cache Database DMCDM of Wuhan Damon Database Co. which can be exploited by attackers to cause a denial of service...

Fedora: Security Advisory (FEDORA-2024-e7bb8bc2da)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES12: libpcp-devel / libpcp3 / libpcp_gui2 / libpcp_import1 / libpcp_mmv1 / etc (SUSE-SU-2024:3976-1)

"The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3976-1 advisory. pcp was updated from version 3.11.9 to version 6.2.0 jscPED-8192, jscPED-8389: - Security issues fixed: CVE-2024-45770: Fixed a...

Denial-of-service due to malformed ACL selectors in Redis

...

ALSA-2024:9472 Important: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fixes: encoding/gob: golang: Calling Decoder.Decode on a message which contains deepl...