Critical Security Update for Redis: Remote Code Execution and Denial-of-Service Vulnerabilities
Summary
ALSA-2025:0692: Important: redis:7 security update. Affects redis versions < 7.2.7-1.module_el9.5.0+134+2e645600. Fixed in 7.2.7-1.module_el9.5.0+134+2e645600. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Redis is an advanced key-value store often referred to as a data-structure server, allowing users to store various types of data structures such as strings, hashes, lists, sets, and sorted sets. It operates primarily in-memory for performance, with options for data persistence through periodic dumps or command logging. The recent vulnerabilities discovered in Redis highlight significant security risks that could affect its reliability and integrity.
Vulnerability Detail
The vulnerabilities in Redis stem from issues in its Lua library commands, which may lead to remote code execution (CVE-2024-46981). Additionally, malformed Access Control List (ACL) selectors can cause denial-of-service attacks (CVE-2024-51741). These vulnerabilities can be exploited by attackers to execute arbitrary code on the server or disrupt service availability, posing serious risks to applications relying on Redis for data management.
How To Fix
Minimum fixed version
7.2.7-1.module_el9.5.0+134+2e645600
This is the first release that contains the fix.
sudo dnf update redisTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider restricting access to Redis by implementing firewall rules or using a VPN to limit exposure to trusted networks. Additionally, review and tighten your ACL configurations to mitigate the risk of denial-of-service attacks.
Conclusion
The Redis security update addresses critical vulnerabilities that could lead to remote code execution and denial-of-service attacks. It is crucial for users to update their installations to the patched version to ensure the security and reliability of their applications. Implementing workarounds can provide temporary relief, but a full update is the best course of action.
See every vulnerability recorded for redis →
FAQ
Redis is an advanced key-value store that functions as a data-structure server, allowing for efficient storage and retrieval of various data types.
The main vulnerabilities include potential remote code execution through Lua library commands and denial-of-service due to malformed ACL selectors.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any installation.
If an immediate update is not possible, implement firewall rules and review ACL configurations to limit exposure and mitigate risks.
For more details, refer to the CVE pages for CVE-2024-46981 and CVE-2024-51741, which provide in-depth information about the vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for redis.
