Critical Security Update for Redis: Addressing Multiple Vulnerabilities
Summary
ALSA-2025:0693: Important: redis security update. Affects redis versions < 6.2.17-1.el9_5. Fixed in 6.2.17-1.el9_5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Redis is an advanced key-value store, often referred to as a data-structure server, capable of handling various data types such as strings, hashes, lists, sets, and sorted sets. It operates primarily in-memory for performance, with options for data persistence through periodic dumps or command logging. This flexibility makes Redis a popular choice for applications requiring fast data access. However, recent vulnerabilities have been identified that could compromise its security and stability.
Vulnerability Detail
The vulnerabilities in Redis stem from several issues, including a heap overflow in the lua cjson and cmsgpack libraries (CVE-2022-24834), a potential bypass of Unix socket permissions on startup (CVE-2023-45145), and Lua library commands that may lead to stack overflow and remote code execution (CVE-2024-31449). Additionally, there is a denial-of-service risk due to unbounded pattern matching (CVE-2024-31228) and further remote code execution vulnerabilities associated with Lua library commands (CVE-2024-46981). These vulnerabilities could allow attackers to execute arbitrary code, disrupt service, or gain unauthorized access to sensitive data.
How To Fix
Minimum fixed version
6.2.17-1.el9_5
This is the first release that contains the fix.
sudo dnf update redisTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to Redis by configuring firewall rules to limit connections to trusted IP addresses only. Additionally, disabling Lua scripting can mitigate some risks until the update is applied. This can be done by setting 'lua-time-limit' to a lower value in the Redis configuration file.
Conclusion
The identified vulnerabilities in Redis pose significant risks that could lead to unauthorized access and service disruption. It is crucial for users to update their Redis installations to the latest patched version to safeguard their applications. Implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for redis →
FAQ
Redis is an advanced key-value store that functions as a data-structure server, supporting various data types and offering high performance through in-memory operations.
The main vulnerabilities include heap overflow, Unix socket permission bypass, stack overflow, denial-of-service due to unbounded pattern matching, and remote code execution through Lua commands.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading a manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
If an immediate update is not possible, consider implementing firewall rules to restrict access and disabling Lua scripting as temporary workarounds.
For detailed information, refer to the CVE pages associated with each vulnerability, which provide insights into their impact and mitigation strategies.
Related vulnerabilities
Recent vulnerabilities recorded for redis.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
