Heap overflow issue with the Lua cjson library used by Redis
Résumé
Heap overflow issue with the Lua cjson library used by Redis
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. The problem is fixed in versions 7.0.12, 6.2.13, and 6.0.20.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Alpine Linux ALPINE-CVE-2022-24834 redis Corrigé dans: 7.0.12-r0
- Debian DEBIAN-CVE-2022-24834 redis Corrigé dans: 5:6.0.16-1+deb11u3
- Ubuntu UBUNTU-CVE-2022-24834 redis Corrigé dans: 2:2.8.4-2ubuntu0.2+esm3
Références
- advisory github.com
- advisory security.netapp.com
- advisory nvd.nist.gov
- advisory github.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org