Lua library commands may lead to stack overflow and RCE in Redis
概要
Lua library commands may lead to stack overflow and RCE in Redis
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Alpine Linux ALPINE-CVE-2024-31449 redis 修正版: 6.2.18-r0
- Debian DEBIAN-CVE-2024-31449 redict 修正版: 7.3.1+ds-1
- Ubuntu UBUNTU-CVE-2024-31449 redis 修正版: 2:3.0.6-1ubuntu0.4+esm5
参照URL
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- patch github.com