RHSA-2025:0685HighCVSS 7.0

Red Hat Security Advisory: redis:6 security update

Published
January 27, 2025
Last Modified
August 15, 2026

🔗 CVE IDs covered (1)

CVE-2024-46981 →

📋 Description

CVE-2024-46981 — redis: Redis' Lua library commands may lead to remote code execution

🎯 Affected products25

  • Red Hat Enterprise Linux AppStream AUS (v.8.4)
  • Red Hat Enterprise Linux AppStream E4S (v.8.4)
  • Red Hat Enterprise Linux AppStream TUS (v.8.4)
  • redis-0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1.ppc64le (redis:6) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.4)
  • redis-0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1.src (redis:6) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)
  • redis-0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1.src (redis:6) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.4)
  • redis-0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1.src (redis:6) as a component of Red Hat Enterprise Linux AppStream TUS (v.8.4)
  • redis-0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1.x86_64 (redis:6) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)
  • redis-0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1.x86_64 (redis:6) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.4)
  • redis-0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1.x86_64 (redis:6) as a component of Red Hat Enterprise Linux AppStream TUS (v.8.4)
  • redis-debuginfo-0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1.ppc64le (redis:6) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.4)
  • redis-debuginfo-0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1.x86_64 (redis:6) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)
  • redis-debuginfo-0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1.x86_64 (redis:6) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.4)
  • redis-debuginfo-0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1.x86_64 (redis:6) as a component of Red Hat Enterprise Linux AppStream TUS (v.8.4)
  • redis-debugsource-0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1.ppc64le (redis:6) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.4)
  • redis-debugsource-0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1.x86_64 (redis:6) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)
  • redis-debugsource-0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1.x86_64 (redis:6) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.4)
  • redis-debugsource-0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1.x86_64 (redis:6) as a component of Red Hat Enterprise Linux AppStream TUS (v.8.4)
  • redis-devel-0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1.ppc64le (redis:6) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.4)
  • redis-devel-0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1.x86_64 (redis:6) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)
  • redis-devel-0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1.x86_64 (redis:6) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.4)
  • redis-devel-0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1.x86_64 (redis:6) as a component of Red Hat Enterprise Linux AppStream TUS (v.8.4)
  • redis-doc-0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1.noarch (redis:6) as a component of Red Hat Enterprise Linux AppStream AUS (v.8.4)
  • redis-doc-0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1.noarch (redis:6) as a component of Red Hat Enterprise Linux AppStream E4S (v.8.4)
  • redis-doc-0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1.noarch (redis:6) as a component of Red Hat Enterprise Linux AppStream TUS (v.8.4)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

🔗 References (4)