CVE-2024-31449

Lua library commands may lead to stack overflow and RCE in Redis

Summary

Original description

The description as published by the source.

Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Affected packages

Bitnami keydb

[{"type":"SEMVER","events":[{"introduced":"2.6.0"},{"fixed":"6.3.4"},{"introduced":"7.0.0"}]}]

Bitnami redis

[{"type":"SEMVER","events":[{"introduced":"2.6.0"},{"fixed":"6.2.16"},{"introduced":"7.0.0"},{"fixed":"7.2.8"},{"introduced":"7.3.0"},{"fixed":"7.4.1"}]}]

Bitnami valkey

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.2.7"},{"introduced":"8.0.0"},{"fixed":"8.0.1"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Alpine Linux ALPINE-CVE-2024-31449 redis Fixed in: 6.2.18-r0
Debian DEBIAN-CVE-2024-31449 redict Fixed in: 7.3.1+ds-1
Ubuntu UBUNTU-CVE-2024-31449 redis Fixed in: 2:3.0.6-1ubuntu0.4+esm5

References

advisory github.com
advisory nvd.nist.gov
advisory github.com
patch github.com

Metadata

CVE: CVE-2024-31449
GHSA: GHSA-whxg-wx83-85p5
Published: 2024-10-07
First seen on SecPulse: 2 years ago
First-seen source: OSV.dev (Open Source Vulnerabilities)

CWE

CWE-121 CWE-20

Detection sources

OSV.dev (Open Source Vulnerabilities) 2 months ago