edis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. The problem is fixed in Redis versions 7.0.0 and 6.2.7. An additional workaround to mitigate this problem without patching the redis-server executable, if Lua scripting is not being used, is to block access to `SCRIPT LOAD` and `EVAL` commands using ACL rules. References: https://github.com/redis/redis/pull/10651 https://github.com/redis/redis/security/advisories/GHSA-3qpw-7686-5984 https://github.com/redis/redis/releases/tag/7.0.0 https://github.com/redis/redis/releases/tag/6.2.7
Created redis tracking bugs for this issue: Affects: epel-7 [bug 2080291] Affects: fedora-all [bug 2080290]
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:7541 https://access.redhat.com/errata/RHSA-2022:7541
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:8096 https://access.redhat.com/errata/RHSA-2022:8096
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-24736