Bug 2317056 (CVE-2024-31449)

Summary: CVE-2024-31449 redis: Lua library commands may lead to stack overflow and RCE in Redis
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akostadi, amasferr, bdettelb, brasmith, brking, chazlett, cochase, dmayorov, doconnor, dranck, gtanzill, haoli, hkataria, jcammara, jlledo, jmitchel, jneedle, kshier, mabashia, mjaros, mmakovy, pbraun, simaishi, smcdonal, stcannon, teagle, tfister, thavo, tjochec, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in Redis. This flaw allows an authenticated user to use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may lead to remote code execution. The problem exists in all versions of Redis with Lua scripting.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2317407, 2317408, 2414769, 2414770, 2414771, 2414772    
Bug Blocks:    

Description OSIDB Bzimport 2024-10-07 20:01:44 UTC 
Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Comment 1 errata-xmlrpc 2024-12-05 21:41:05 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:10869 https://access.redhat.com/errata/RHSA-2024:10869
Comment 2 errata-xmlrpc 2025-01-22 10:36:39 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:0595 https://access.redhat.com/errata/RHSA-2025:0595
Comment 3 errata-xmlrpc 2025-01-27 01:25:13 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:0693 https://access.redhat.com/errata/RHSA-2025:0693