RHSA-2025:0566HighCVSS 7.0

Red Hat Security Advisory: redis:7 security update

Published
January 21, 2025
Last Modified
August 15, 2026

🔗 CVE IDs covered (1)

CVE-2024-46981 →

📋 Description

CVE-2024-46981 — redis: Redis' Lua library commands may lead to remote code execution

🎯 Affected products19

  • Red Hat Enterprise Linux AppStream EUS (v.9.4)
  • redis-0:7.0.12-1.module+el9.4.0+22724+5f7cf862.2.aarch64 (redis:7) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)
  • redis-0:7.0.12-1.module+el9.4.0+22724+5f7cf862.2.ppc64le (redis:7) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)
  • redis-0:7.0.12-1.module+el9.4.0+22724+5f7cf862.2.s390x (redis:7) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)
  • redis-0:7.0.12-1.module+el9.4.0+22724+5f7cf862.2.src (redis:7) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)
  • redis-0:7.0.12-1.module+el9.4.0+22724+5f7cf862.2.x86_64 (redis:7) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)
  • redis-debuginfo-0:7.0.12-1.module+el9.4.0+22724+5f7cf862.2.aarch64 (redis:7) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)
  • redis-debuginfo-0:7.0.12-1.module+el9.4.0+22724+5f7cf862.2.ppc64le (redis:7) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)
  • redis-debuginfo-0:7.0.12-1.module+el9.4.0+22724+5f7cf862.2.s390x (redis:7) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)
  • redis-debuginfo-0:7.0.12-1.module+el9.4.0+22724+5f7cf862.2.x86_64 (redis:7) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)
  • redis-debugsource-0:7.0.12-1.module+el9.4.0+22724+5f7cf862.2.aarch64 (redis:7) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)
  • redis-debugsource-0:7.0.12-1.module+el9.4.0+22724+5f7cf862.2.ppc64le (redis:7) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)
  • redis-debugsource-0:7.0.12-1.module+el9.4.0+22724+5f7cf862.2.s390x (redis:7) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)
  • redis-debugsource-0:7.0.12-1.module+el9.4.0+22724+5f7cf862.2.x86_64 (redis:7) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)
  • redis-devel-0:7.0.12-1.module+el9.4.0+22724+5f7cf862.2.aarch64 (redis:7) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)
  • redis-devel-0:7.0.12-1.module+el9.4.0+22724+5f7cf862.2.ppc64le (redis:7) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)
  • redis-devel-0:7.0.12-1.module+el9.4.0+22724+5f7cf862.2.s390x (redis:7) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)
  • redis-devel-0:7.0.12-1.module+el9.4.0+22724+5f7cf862.2.x86_64 (redis:7) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)
  • redis-doc-0:7.0.12-1.module+el9.4.0+22724+5f7cf862.2.noarch (redis:7) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

🔗 References (4)