RHSA-2025:0640HighCVSS 7.0

Red Hat Security Advisory: redis:6 security update

Published
January 23, 2025
Last Modified
August 15, 2026

🔗 CVE IDs covered (1)

CVE-2024-46981 →

📋 Description

CVE-2024-46981 — redis: Redis' Lua library commands may lead to remote code execution

🎯 Affected products19

  • Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • redis-0:6.2.7-1.module+el8.8.0+22725+e1c935f8.1.aarch64 (redis:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • redis-0:6.2.7-1.module+el8.8.0+22725+e1c935f8.1.ppc64le (redis:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • redis-0:6.2.7-1.module+el8.8.0+22725+e1c935f8.1.s390x (redis:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • redis-0:6.2.7-1.module+el8.8.0+22725+e1c935f8.1.src (redis:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • redis-0:6.2.7-1.module+el8.8.0+22725+e1c935f8.1.x86_64 (redis:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • redis-debuginfo-0:6.2.7-1.module+el8.8.0+22725+e1c935f8.1.aarch64 (redis:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • redis-debuginfo-0:6.2.7-1.module+el8.8.0+22725+e1c935f8.1.ppc64le (redis:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • redis-debuginfo-0:6.2.7-1.module+el8.8.0+22725+e1c935f8.1.s390x (redis:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • redis-debuginfo-0:6.2.7-1.module+el8.8.0+22725+e1c935f8.1.x86_64 (redis:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • redis-debugsource-0:6.2.7-1.module+el8.8.0+22725+e1c935f8.1.aarch64 (redis:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • redis-debugsource-0:6.2.7-1.module+el8.8.0+22725+e1c935f8.1.ppc64le (redis:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • redis-debugsource-0:6.2.7-1.module+el8.8.0+22725+e1c935f8.1.s390x (redis:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • redis-debugsource-0:6.2.7-1.module+el8.8.0+22725+e1c935f8.1.x86_64 (redis:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • redis-devel-0:6.2.7-1.module+el8.8.0+22725+e1c935f8.1.aarch64 (redis:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • redis-devel-0:6.2.7-1.module+el8.8.0+22725+e1c935f8.1.ppc64le (redis:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • redis-devel-0:6.2.7-1.module+el8.8.0+22725+e1c935f8.1.s390x (redis:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • redis-devel-0:6.2.7-1.module+el8.8.0+22725+e1c935f8.1.x86_64 (redis:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)
  • redis-doc-0:6.2.7-1.module+el8.8.0+22725+e1c935f8.1.noarch (redis:6) as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

🔗 References (4)