RHSA-2022:7541LowCVSS 3.9

Red Hat Security Advisory: redis:6 security, bug fix, and enhancement update

Published
November 8, 2022
Last Modified
August 4, 2026

🔗 CVE IDs covered (2)

CVE-2022-24735 →CVE-2022-24736 →

📋 Description

CVE-2022-24735 — redis: Code injection via Lua script execution environment CVE-2022-24736 — redis: Malformed Lua script can crash Redis

🎯 Affected products19

  • Red Hat Enterprise Linux AppStream (v. 8)
  • redis-0:6.2.7-1.module+el8.7.0+15197+cc495aeb.aarch64 (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-0:6.2.7-1.module+el8.7.0+15197+cc495aeb.ppc64le (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-0:6.2.7-1.module+el8.7.0+15197+cc495aeb.s390x (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-0:6.2.7-1.module+el8.7.0+15197+cc495aeb.src (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-0:6.2.7-1.module+el8.7.0+15197+cc495aeb.x86_64 (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-debuginfo-0:6.2.7-1.module+el8.7.0+15197+cc495aeb.aarch64 (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-debuginfo-0:6.2.7-1.module+el8.7.0+15197+cc495aeb.ppc64le (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-debuginfo-0:6.2.7-1.module+el8.7.0+15197+cc495aeb.s390x (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-debuginfo-0:6.2.7-1.module+el8.7.0+15197+cc495aeb.x86_64 (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-debugsource-0:6.2.7-1.module+el8.7.0+15197+cc495aeb.aarch64 (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-debugsource-0:6.2.7-1.module+el8.7.0+15197+cc495aeb.ppc64le (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-debugsource-0:6.2.7-1.module+el8.7.0+15197+cc495aeb.s390x (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-debugsource-0:6.2.7-1.module+el8.7.0+15197+cc495aeb.x86_64 (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-devel-0:6.2.7-1.module+el8.7.0+15197+cc495aeb.aarch64 (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-devel-0:6.2.7-1.module+el8.7.0+15197+cc495aeb.ppc64le (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-devel-0:6.2.7-1.module+el8.7.0+15197+cc495aeb.s390x (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-devel-0:6.2.7-1.module+el8.7.0+15197+cc495aeb.x86_64 (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-doc-0:6.2.7-1.module+el8.7.0+15197+cc495aeb.noarch (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: If Lua scripting is not being used, this vulnerability can be mitigated by blocking access to SCRIPT LOAD and EVAL commands using ACL rules. Workaround: If Lua scripting is not being used, this vulnerability can be mitigated by preventing access to SCRIPT LOAD and EVAL commands using ACL rules.

🔗 References (7)