Denial of Service Vulnerability in Redis - CVE-2024-51741
Summary
ALPINE-CVE-2024-51741: Redis is an open source, in-memory database that persists on disk. Affects redis versions < 7.0.15-r2. Fixed in 7.0.15-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Redis is an open-source, in-memory database known for its high performance and versatility, allowing data persistence on disk. It is widely used for caching, session management, and real-time analytics due to its speed and support for various data structures. However, Redis can be vulnerable to certain security issues, including malformed ACL selectors that can lead to server instability.
Vulnerability Detail
The vulnerability identified as CVE-2024-51741 allows an authenticated user with sufficient privileges to create a malformed ACL selector. When this malformed selector is accessed, it triggers a server panic, resulting in a denial of service (DoS). This issue can severely impact the availability of the Redis service, making it inaccessible to legitimate users. The vulnerability affects multiple versions of Redis across different Alpine Linux releases.
How To Fix
Minimum fixed version
7.0.15-r2
This is the first release that contains the fix.
sudo apk add --upgrade redisTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the Redis server by implementing stricter ACL rules or by limiting the user privileges until the package is updated to a secure version.
Conclusion
CVE-2024-51741 is a critical vulnerability in Redis that can lead to denial of service if exploited. It is essential to update to the patched versions provided for various Alpine Linux releases to ensure the security and availability of your Redis service. Additionally, using tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for redis →
FAQ
CVE-2024-51741 is a vulnerability in Redis that allows an authenticated user to create a malformed ACL selector, leading to a denial of service.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
The vulnerability can cause a server panic, resulting in a denial of service, making Redis unavailable to users.
Use the command 'apk add redis=<version>' to update to the patched version, replacing <version> with the appropriate fixed version for your Alpine Linux release.
Yes, you can implement stricter ACL rules or limit user privileges as a temporary workaround until the package is updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for redis.
