RHSA-2025:0692HighCVSS 7.0

Red Hat Security Advisory: redis:7 security update

Published
January 27, 2025
Last Modified
August 15, 2026

🔗 CVE IDs covered (2)

CVE-2024-51741 →CVE-2024-46981 →

📋 Description

CVE-2024-46981 — redis: Redis' Lua library commands may lead to remote code execution CVE-2024-51741 — redis: Redis allows denial-of-service due to malformed ACL selectors

🎯 Affected products19

  • Red Hat Enterprise Linux AppStream (v. 9)
  • redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64 (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.src (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64 (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64 (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64 (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64 (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64 (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64 (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64 (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • redis-doc-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.noarch (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

🔗 References (5)