What is RHSA-2022:8096?

RHSA-2022:8096 is a security advisory published by Red Hat Product Security with Low severity. Red Hat Security Advisory: redis security and bug fix update

Which CVE IDs does RHSA-2022:8096 cover?

RHSA-2022:8096 covers the following CVE IDs: CVE-2022-24735, CVE-2022-24736. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of RHSA-2022:8096?

RHSA-2022:8096 has a CVSS v3 base score of 3.9, published by Red Hat Product Security.

Which products are affected by RHSA-2022:8096?

RHSA-2022:8096 affects 22 products, including: Red Hat Enterprise Linux AppStream (v. 9); redis-0:6.2.7-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9); redis-0:6.2.7-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9); redis-0:6.2.7-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9); redis-0:6.2.7-1.el9.src as a component of Red Hat Enterprise Linux AppStream (v. 9); and others — see the full list on the advisory page.

RHSA-2022:8096: Red Hat Security Advisory: r…

🔗 CVE IDs covered (2)

CVE-2022-24735 →CVE-2022-24736 →

📋 Description

CVE-2022-24735 — redis: Code injection via Lua script execution environment CVE-2022-24736 — redis: Malformed Lua script can crash Redis

🎯 Affected products22

Red Hat Enterprise Linux AppStream (v. 9)
redis-0:6.2.7-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
redis-0:6.2.7-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
redis-0:6.2.7-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
redis-0:6.2.7-1.el9.src as a component of Red Hat Enterprise Linux AppStream (v. 9)
redis-0:6.2.7-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
redis-debuginfo-0:6.2.7-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
redis-debuginfo-0:6.2.7-1.el9.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
redis-debuginfo-0:6.2.7-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
redis-debuginfo-0:6.2.7-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
redis-debuginfo-0:6.2.7-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
redis-debugsource-0:6.2.7-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
redis-debugsource-0:6.2.7-1.el9.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
redis-debugsource-0:6.2.7-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
redis-debugsource-0:6.2.7-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
redis-debugsource-0:6.2.7-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
redis-devel-0:6.2.7-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
redis-devel-0:6.2.7-1.el9.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
redis-devel-0:6.2.7-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
redis-devel-0:6.2.7-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
redis-devel-0:6.2.7-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
redis-doc-0:6.2.7-1.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: If Lua scripting is not being used, this vulnerability can be mitigated by blocking access to SCRIPT LOAD and EVAL commands using ACL rules. Workaround: If Lua scripting is not being used, this vulnerability can be mitigated by preventing access to SCRIPT LOAD and EVAL commands using ACL rules.

🔗 CVE IDs covered (2)

📋 Description

🎯 Affected products22

✅ Remediation

🔗 References (7)