CVE-2024-46981

Katalog CVE

CVSS 9.8 · Critical EPSS 8,2%

Kerentanan Use After Free pada redis, debian linux. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

Rincian

Terbit di NVD

6 Januari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-416: Use After Free

EPSS (30 hari)

8,2% peluang dieksploitasi; lebih tinggi dari 94,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/redis/redis/security/advisories/GHSA-39h2-x6c4-6w4c advisory vendor
• https://lists.debian.org/debian-lts-announce/2025/01/msg00018.html mailing list · advisory pihak ketiga
• https://www.vicarius.io/vsociety/posts/cve-2024-46981-detect-redis-vulnerability exploit · advisory pihak ketiga
• https://www.vicarius.io/vsociety/posts/cve-2024-46981-mitigate-redis-vulnerability exploit · advisory pihak ketiga
• https://github.com/redis/redis/releases/tag/6.2.17 release notes
• https://github.com/redis/redis/releases/tag/7.2.7 release notes
• https://github.com/redis/redis/releases/tag/7.4.2 release notes