Vulnerability-Lookup

CVE-2024-51741 (GCVE-0-2024-51741)

Vulnerability from cvelistv5 – Published: 2025-01-06 21:20 – Updated: 2025-01-06 21:39

Title

Redis allows denial-of-service due to malformed ACL selectors

Summary

Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem is fixed in Redis 7.2.7 and 7.4.2.

Severity

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-20 - Improper Input Validation

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/redis/redis/security/advisorie…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
redis	redis	Affected: >= 7.0.0, < 7.2.7 Affected: >= 7.4.0, < 7.4.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-51741",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-06T21:38:56.131035Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-06T21:39:28.426Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "redis",
          "vendor": "redis",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.2.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.4.0, \u003c 7.4.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem is fixed in Redis 7.2.7 and 7.4.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-06T21:20:19.772Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/redis/redis/security/advisories/GHSA-prpq-rh5h-46g9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/redis/redis/security/advisories/GHSA-prpq-rh5h-46g9"
        }
      ],
      "source": {
        "advisory": "GHSA-prpq-rh5h-46g9",
        "discovery": "UNKNOWN"
      },
      "title": "Redis allows denial-of-service due to malformed ACL selectors"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-51741",
    "datePublished": "2025-01-06T21:20:19.772Z",
    "dateReserved": "2024-10-31T14:12:45.789Z",
    "dateUpdated": "2025-01-06T21:39:28.426Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-51741",
      "date": "2026-06-04",
      "epss": "0.00756",
      "percentile": "0.73617"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-51741\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2025-01-06T22:15:09.827\",\"lastModified\":\"2025-09-05T14:25:29.293\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem is fixed in Redis 7.2.7 and 7.4.2.\"},{\"lang\":\"es\",\"value\":\"Redis es una base de datos en memoria de c\u00f3digo abierto que persiste en el disco. Un usuario autenticado con privilegios suficientes puede crear un selector de ACL mal formado que, cuando se accede a \u00e9l, desencadena un p\u00e1nico del servidor y la consiguiente denegaci\u00f3n de servicio. El problema se solucion\u00f3 en Redis 7.2.7 y 7.4.2.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":0.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.0.0\",\"versionEndExcluding\":\"7.2.7\",\"matchCriteriaId\":\"6712988E-3667-488C-9AD2-B49176BA362B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.4.0\",\"versionEndExcluding\":\"7.4.2\",\"matchCriteriaId\":\"4C650091-3AC4-4A82-99E8-265600DBD02E\"}]}]}],\"references\":[{\"url\":\"https://github.com/redis/redis/security/advisories/GHSA-prpq-rh5h-46g9\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-51741\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-01-06T21:38:56.131035Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-01-06T21:39:22.120Z\"}}], \"cna\": {\"title\": \"Redis allows denial-of-service due to malformed ACL selectors\", \"source\": {\"advisory\": \"GHSA-prpq-rh5h-46g9\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.4, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"redis\", \"product\": \"redis\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 7.0.0, \u003c 7.2.7\"}, {\"status\": \"affected\", \"version\": \"\u003e= 7.4.0, \u003c 7.4.2\"}]}], \"references\": [{\"url\": \"https://github.com/redis/redis/security/advisories/GHSA-prpq-rh5h-46g9\", \"name\": \"https://github.com/redis/redis/security/advisories/GHSA-prpq-rh5h-46g9\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem is fixed in Redis 7.2.7 and 7.4.2.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20: Improper Input Validation\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2025-01-06T21:20:19.772Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-51741\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-01-06T21:39:28.426Z\", \"dateReserved\": \"2024-10-31T14:12:45.789Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2025-01-06T21:20:19.772Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

RHSA-2025:0692

Vulnerability from csaf_redhat - Published: 2025-01-27 01:43 - Updated: 2026-03-18 02:50

Summary

Red Hat Security Advisory: redis:7 security update

Severity

Important

Notes

Topic: An update for the redis:7 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log. Security Fix(es): * redis: Redis' Lua library commands may lead to remote code execution (CVE-2024-46981) * redis: Redis allows denial-of-service due to malformed ACL selectors (CVE-2024-51741) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2024-46981

A flaw was found in the Redis server. This flaw allows an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, potentially leading to remote code execution.

7.0 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 18 products

Product	Version	Remediation
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.src::redis:7	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-doc-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.noarch::redis:7	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2024-51741

A flaw was found in the Redis server. An authenticated attacker with sufficient privileges can create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service.

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 18 products

Product	Version	Remediation
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7	—	Vendor Fix fix
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7	—	Vendor Fix fix
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7	—	Vendor Fix fix
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.src::redis:7	—	Vendor Fix fix
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7	—	Vendor Fix fix
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7	—	Vendor Fix fix
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7	—	Vendor Fix fix
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7	—	Vendor Fix fix
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7	—	Vendor Fix fix
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7	—	Vendor Fix fix
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7	—	Vendor Fix fix
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7	—	Vendor Fix fix
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7	—	Vendor Fix fix
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7	—	Vendor Fix fix
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7	—	Vendor Fix fix
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7	—	Vendor Fix fix
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7	—	Vendor Fix fix
Unresolved product id: AppStream-9.5.0.Z.MAIN:redis-doc-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.noarch::redis:7	—	Vendor Fix fix

Threats

Impact Moderate

References

18 references

URL	Category
https://access.redhat.com/errata/RHSA-2025:0692	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2336004	external
https://bugzilla.redhat.com/show_bug.cgi?id=2336007	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2024-46981	self
https://bugzilla.redhat.com/show_bug.cgi?id=2336004	external
https://www.cve.org/CVERecord?id=CVE-2024-46981	external
https://nvd.nist.gov/vuln/detail/CVE-2024-46981	external
https://github.com/redis/redis/releases/tag/6.2.17	external
https://github.com/redis/redis/releases/tag/7.2.7	external
https://github.com/redis/redis/releases/tag/7.4.2	external
https://github.com/redis/redis/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2024-51741	self
https://bugzilla.redhat.com/show_bug.cgi?id=2336007	external
https://www.cve.org/CVERecord?id=CVE-2024-51741	external
https://nvd.nist.gov/vuln/detail/CVE-2024-51741	external
https://github.com/redis/redis/security/advisorie…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the redis:7 module is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.\n\nSecurity Fix(es):\n\n* redis: Redis\u0027 Lua library commands may lead to remote code execution (CVE-2024-46981)\n\n* redis: Redis allows denial-of-service due to malformed ACL selectors (CVE-2024-51741)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2025:0692",
        "url": "https://access.redhat.com/errata/RHSA-2025:0692"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2336004",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2336004"
      },
      {
        "category": "external",
        "summary": "2336007",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2336007"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0692.json"
      }
    ],
    "title": "Red Hat Security Advisory: redis:7 security update",
    "tracking": {
      "current_release_date": "2026-03-18T02:50:19+00:00",
      "generator": {
        "date": "2026-03-18T02:50:19+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.3"
        }
      },
      "id": "RHSA-2025:0692",
      "initial_release_date": "2025-01-27T01:43:02+00:00",
      "revision_history": [
        {
          "date": "2025-01-27T01:43:02+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-01-27T01:43:02+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-03-18T02:50:19+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.5.0.Z.MAIN",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.src::redis:7",
                "product": {
                  "name": "redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.src (redis:7)",
                  "product_id": "redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.src::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis@7.2.7-1.module%2Bel9.5.0%2B22705%2B3d861c1c?arch=src\u0026rpmmod=redis:7:9050020250115104757:9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-doc-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.noarch::redis:7",
                "product": {
                  "name": "redis-doc-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.noarch (redis:7)",
                  "product_id": "redis-doc-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.noarch::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-doc@7.2.7-1.module%2Bel9.5.0%2B22705%2B3d861c1c?arch=noarch\u0026rpmmod=redis:7:9050020250115104757:9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
                "product": {
                  "name": "redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64 (redis:7)",
                  "product_id": "redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis@7.2.7-1.module%2Bel9.5.0%2B22705%2B3d861c1c?arch=aarch64\u0026rpmmod=redis:7:9050020250115104757:9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
                "product": {
                  "name": "redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64 (redis:7)",
                  "product_id": "redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debuginfo@7.2.7-1.module%2Bel9.5.0%2B22705%2B3d861c1c?arch=aarch64\u0026rpmmod=redis:7:9050020250115104757:9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
                "product": {
                  "name": "redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64 (redis:7)",
                  "product_id": "redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debugsource@7.2.7-1.module%2Bel9.5.0%2B22705%2B3d861c1c?arch=aarch64\u0026rpmmod=redis:7:9050020250115104757:9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
                "product": {
                  "name": "redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64 (redis:7)",
                  "product_id": "redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-devel@7.2.7-1.module%2Bel9.5.0%2B22705%2B3d861c1c?arch=aarch64\u0026rpmmod=redis:7:9050020250115104757:9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
                "product": {
                  "name": "redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le (redis:7)",
                  "product_id": "redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis@7.2.7-1.module%2Bel9.5.0%2B22705%2B3d861c1c?arch=ppc64le\u0026rpmmod=redis:7:9050020250115104757:9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
                "product": {
                  "name": "redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le (redis:7)",
                  "product_id": "redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debuginfo@7.2.7-1.module%2Bel9.5.0%2B22705%2B3d861c1c?arch=ppc64le\u0026rpmmod=redis:7:9050020250115104757:9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
                "product": {
                  "name": "redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le (redis:7)",
                  "product_id": "redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debugsource@7.2.7-1.module%2Bel9.5.0%2B22705%2B3d861c1c?arch=ppc64le\u0026rpmmod=redis:7:9050020250115104757:9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
                "product": {
                  "name": "redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le (redis:7)",
                  "product_id": "redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-devel@7.2.7-1.module%2Bel9.5.0%2B22705%2B3d861c1c?arch=ppc64le\u0026rpmmod=redis:7:9050020250115104757:9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
                "product": {
                  "name": "redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x (redis:7)",
                  "product_id": "redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis@7.2.7-1.module%2Bel9.5.0%2B22705%2B3d861c1c?arch=s390x\u0026rpmmod=redis:7:9050020250115104757:9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
                "product": {
                  "name": "redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x (redis:7)",
                  "product_id": "redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debuginfo@7.2.7-1.module%2Bel9.5.0%2B22705%2B3d861c1c?arch=s390x\u0026rpmmod=redis:7:9050020250115104757:9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
                "product": {
                  "name": "redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x (redis:7)",
                  "product_id": "redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debugsource@7.2.7-1.module%2Bel9.5.0%2B22705%2B3d861c1c?arch=s390x\u0026rpmmod=redis:7:9050020250115104757:9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
                "product": {
                  "name": "redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x (redis:7)",
                  "product_id": "redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-devel@7.2.7-1.module%2Bel9.5.0%2B22705%2B3d861c1c?arch=s390x\u0026rpmmod=redis:7:9050020250115104757:9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
                "product": {
                  "name": "redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64 (redis:7)",
                  "product_id": "redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis@7.2.7-1.module%2Bel9.5.0%2B22705%2B3d861c1c?arch=x86_64\u0026rpmmod=redis:7:9050020250115104757:9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
                "product": {
                  "name": "redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64 (redis:7)",
                  "product_id": "redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debuginfo@7.2.7-1.module%2Bel9.5.0%2B22705%2B3d861c1c?arch=x86_64\u0026rpmmod=redis:7:9050020250115104757:9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
                "product": {
                  "name": "redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64 (redis:7)",
                  "product_id": "redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debugsource@7.2.7-1.module%2Bel9.5.0%2B22705%2B3d861c1c?arch=x86_64\u0026rpmmod=redis:7:9050020250115104757:9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
                "product": {
                  "name": "redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64 (redis:7)",
                  "product_id": "redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-devel@7.2.7-1.module%2Bel9.5.0%2B22705%2B3d861c1c?arch=x86_64\u0026rpmmod=redis:7:9050020250115104757:9"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64 (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7"
        },
        "product_reference": "redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7"
        },
        "product_reference": "redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7"
        },
        "product_reference": "redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.src (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.src::redis:7"
        },
        "product_reference": "redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.src::redis:7",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64 (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7"
        },
        "product_reference": "redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64 (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7"
        },
        "product_reference": "redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7"
        },
        "product_reference": "redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7"
        },
        "product_reference": "redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64 (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7"
        },
        "product_reference": "redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64 (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7"
        },
        "product_reference": "redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7"
        },
        "product_reference": "redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7"
        },
        "product_reference": "redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64 (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7"
        },
        "product_reference": "redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64 (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7"
        },
        "product_reference": "redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7"
        },
        "product_reference": "redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7"
        },
        "product_reference": "redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64 (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7"
        },
        "product_reference": "redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-doc-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.noarch (redis:7) as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.5.0.Z.MAIN:redis-doc-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.noarch::redis:7"
        },
        "product_reference": "redis-doc-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.noarch::redis:7",
        "relates_to_product_reference": "AppStream-9.5.0.Z.MAIN"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-46981",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2025-01-06T22:00:39.382359+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2336004"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Redis server. This flaw allows an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, potentially leading to remote code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "redis: Redis\u0027 Lua library commands may lead to remote code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The problem exists in all versions of Redis with Lua scripting.\n\nThis vulnerability in Redis is classified as high severity rather than moderate due to its potential impact and exploitation scope. By manipulating the Lua garbage collector through crafted scripts, an authenticated attacker can achieve remote code execution (RCE), allowing them to execute arbitrary commands on the host system. This compromises not only the integrity and confidentiality of the data stored in Redis but also the underlying server itself. Furthermore, the exploitation does not require direct access to the server binary, making it feasible for attackers to execute through legitimate, albeit malicious, commands.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.src::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-doc-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.noarch::redis:7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-46981"
        },
        {
          "category": "external",
          "summary": "RHBZ#2336004",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2336004"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-46981",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-46981"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-46981",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46981"
        },
        {
          "category": "external",
          "summary": "https://github.com/redis/redis/releases/tag/6.2.17",
          "url": "https://github.com/redis/redis/releases/tag/6.2.17"
        },
        {
          "category": "external",
          "summary": "https://github.com/redis/redis/releases/tag/7.2.7",
          "url": "https://github.com/redis/redis/releases/tag/7.2.7"
        },
        {
          "category": "external",
          "summary": "https://github.com/redis/redis/releases/tag/7.4.2",
          "url": "https://github.com/redis/redis/releases/tag/7.4.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/redis/redis/security/advisories/GHSA-39h2-x6c4-6w4c",
          "url": "https://github.com/redis/redis/security/advisories/GHSA-39h2-x6c4-6w4c"
        }
      ],
      "release_date": "2025-01-06T21:11:51.687000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-01-27T01:43:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.src::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-doc-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.noarch::redis:7"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:0692"
        },
        {
          "category": "workaround",
          "details": "A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.",
          "product_ids": [
            "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.src::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-doc-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.noarch::redis:7"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.src::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-doc-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.noarch::redis:7"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "redis: Redis\u0027 Lua library commands may lead to remote code execution"
    },
    {
      "cve": "CVE-2024-51741",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2025-01-06T22:00:50.843954+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2336007"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Redis server. An authenticated attacker with sufficient privileges can create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "redis: Redis allows denial-of-service due to malformed ACL selectors",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability affects Redis versions 7.0.0 or newer.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.src::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
          "AppStream-9.5.0.Z.MAIN:redis-doc-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.noarch::redis:7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-51741"
        },
        {
          "category": "external",
          "summary": "RHBZ#2336007",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2336007"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-51741",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-51741"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-51741",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51741"
        },
        {
          "category": "external",
          "summary": "https://github.com/redis/redis/security/advisories/GHSA-prpq-rh5h-46g9",
          "url": "https://github.com/redis/redis/security/advisories/GHSA-prpq-rh5h-46g9"
        }
      ],
      "release_date": "2025-01-06T21:20:19.772000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-01-27T01:43:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.src::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-doc-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.noarch::redis:7"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:0692"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.src::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debuginfo-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-debugsource-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.aarch64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.ppc64le::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.s390x::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-devel-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.x86_64::redis:7",
            "AppStream-9.5.0.Z.MAIN:redis-doc-0:7.2.7-1.module+el9.5.0+22705+3d861c1c.noarch::redis:7"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "redis: Redis allows denial-of-service due to malformed ACL selectors"
    }
  ]
}

SUSE-SU-2025:0160-1

Vulnerability from csaf_suse - Published: 2025-01-17 14:38 - Updated: 2025-01-17 14:38

Summary

Security update for redis7

Severity

Important

Notes

Title of the patch: Security update for redis7

Description of the patch: This update for redis7 fixes the following issues: - CVE-2024-51741: Fixed a bug where malformed ACL selectors can trigger a server panic when accessed. (bsc#1235386) - CVE-2024-46981: Fixed a bug where lua scripts can be used to manipulate the garbage collector, leading to remote code execution. (bsc#1235387)

Patchnames: SUSE-2025-160,SUSE-SLE-Product-HPC-15-SP5-ESPOS-2025-160,SUSE-SLE-Product-HPC-15-SP5-LTSS-2025-160,SUSE-SLE-Product-SLES-15-SP5-LTSS-2025-160,SUSE-SLE-Product-SLES_SAP-15-SP5-2025-160

CVE-2024-46981

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 10 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:redis7-7.0.8-150500.3.15.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:redis7-7.0.8-150500.3.15.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:redis7-7.0.8-150500.3.15.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:redis7-7.0.8-150500.3.15.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2024-51741

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 10 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:redis7-7.0.8-150500.3.15.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:redis7-7.0.8-150500.3.15.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:redis7-7.0.8-150500.3.15.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:redis7-7.0.8-150500.3.15.1.x86_64	—	Vendor Fix

Threats

Impact moderate

References

12 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-security-upd…	self
https://bugzilla.suse.com/1235386	self
https://bugzilla.suse.com/1235387	self
https://www.suse.com/security/cve/CVE-2024-46981/	self
https://www.suse.com/security/cve/CVE-2024-51741/	self
https://www.suse.com/security/cve/CVE-2024-46981	external
https://bugzilla.suse.com/1235387	external
https://www.suse.com/security/cve/CVE-2024-51741	external
https://bugzilla.suse.com/1235386	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for redis7",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for redis7 fixes the following issues:\n\n- CVE-2024-51741: Fixed a bug where malformed ACL selectors can trigger a server panic when accessed. (bsc#1235386)\n- CVE-2024-46981: Fixed a bug where lua scripts can be used to manipulate the garbage collector, leading to remote code execution. (bsc#1235387)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2025-160,SUSE-SLE-Product-HPC-15-SP5-ESPOS-2025-160,SUSE-SLE-Product-HPC-15-SP5-LTSS-2025-160,SUSE-SLE-Product-SLES-15-SP5-LTSS-2025-160,SUSE-SLE-Product-SLES_SAP-15-SP5-2025-160",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_0160-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2025:0160-1",
        "url": "https://www.suse.com/support/update/announcement/2025/suse-su-20250160-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2025:0160-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-January/020158.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1235386",
        "url": "https://bugzilla.suse.com/1235386"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1235387",
        "url": "https://bugzilla.suse.com/1235387"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-46981 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-46981/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-51741 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-51741/"
      }
    ],
    "title": "Security update for redis7",
    "tracking": {
      "current_release_date": "2025-01-17T14:38:37Z",
      "generator": {
        "date": "2025-01-17T14:38:37Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2025:0160-1",
      "initial_release_date": "2025-01-17T14:38:37Z",
      "revision_history": [
        {
          "date": "2025-01-17T14:38:37Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis7-7.0.8-150500.3.15.1.aarch64",
                "product": {
                  "name": "redis7-7.0.8-150500.3.15.1.aarch64",
                  "product_id": "redis7-7.0.8-150500.3.15.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis7-7.0.8-150500.3.15.1.i586",
                "product": {
                  "name": "redis7-7.0.8-150500.3.15.1.i586",
                  "product_id": "redis7-7.0.8-150500.3.15.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis7-7.0.8-150500.3.15.1.ppc64le",
                "product": {
                  "name": "redis7-7.0.8-150500.3.15.1.ppc64le",
                  "product_id": "redis7-7.0.8-150500.3.15.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis7-7.0.8-150500.3.15.1.s390x",
                "product": {
                  "name": "redis7-7.0.8-150500.3.15.1.s390x",
                  "product_id": "redis7-7.0.8-150500.3.15.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis7-7.0.8-150500.3.15.1.x86_64",
                "product": {
                  "name": "redis7-7.0.8-150500.3.15.1.x86_64",
                  "product_id": "redis7-7.0.8-150500.3.15.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-espos:15:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP5-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP5-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:15:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:15:sp5"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis7-7.0.8-150500.3.15.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:redis7-7.0.8-150500.3.15.1.aarch64"
        },
        "product_reference": "redis7-7.0.8-150500.3.15.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis7-7.0.8-150500.3.15.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:redis7-7.0.8-150500.3.15.1.x86_64"
        },
        "product_reference": "redis7-7.0.8-150500.3.15.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis7-7.0.8-150500.3.15.1.aarch64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.aarch64"
        },
        "product_reference": "redis7-7.0.8-150500.3.15.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis7-7.0.8-150500.3.15.1.x86_64 as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.x86_64"
        },
        "product_reference": "redis7-7.0.8-150500.3.15.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis7-7.0.8-150500.3.15.1.aarch64 as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.aarch64"
        },
        "product_reference": "redis7-7.0.8-150500.3.15.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis7-7.0.8-150500.3.15.1.ppc64le as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.ppc64le"
        },
        "product_reference": "redis7-7.0.8-150500.3.15.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis7-7.0.8-150500.3.15.1.s390x as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.s390x"
        },
        "product_reference": "redis7-7.0.8-150500.3.15.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis7-7.0.8-150500.3.15.1.x86_64 as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.x86_64"
        },
        "product_reference": "redis7-7.0.8-150500.3.15.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis7-7.0.8-150500.3.15.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:redis7-7.0.8-150500.3.15.1.ppc64le"
        },
        "product_reference": "redis7-7.0.8-150500.3.15.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis7-7.0.8-150500.3.15.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:redis7-7.0.8-150500.3.15.1.x86_64"
        },
        "product_reference": "redis7-7.0.8-150500.3.15.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-46981",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-46981"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:redis7-7.0.8-150500.3.15.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:redis7-7.0.8-150500.3.15.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.s390x",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:redis7-7.0.8-150500.3.15.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:redis7-7.0.8-150500.3.15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-46981",
          "url": "https://www.suse.com/security/cve/CVE-2024-46981"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1235387 for CVE-2024-46981",
          "url": "https://bugzilla.suse.com/1235387"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:redis7-7.0.8-150500.3.15.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:redis7-7.0.8-150500.3.15.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.s390x",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:redis7-7.0.8-150500.3.15.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:redis7-7.0.8-150500.3.15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:redis7-7.0.8-150500.3.15.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:redis7-7.0.8-150500.3.15.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.s390x",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:redis7-7.0.8-150500.3.15.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:redis7-7.0.8-150500.3.15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-01-17T14:38:37Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-46981"
    },
    {
      "cve": "CVE-2024-51741",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-51741"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem is fixed in Redis 7.2.7 and 7.4.2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:redis7-7.0.8-150500.3.15.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:redis7-7.0.8-150500.3.15.1.x86_64",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.aarch64",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.x86_64",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.aarch64",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.ppc64le",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.s390x",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:redis7-7.0.8-150500.3.15.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:redis7-7.0.8-150500.3.15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-51741",
          "url": "https://www.suse.com/security/cve/CVE-2024-51741"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1235386 for CVE-2024-51741",
          "url": "https://bugzilla.suse.com/1235386"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:redis7-7.0.8-150500.3.15.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:redis7-7.0.8-150500.3.15.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.s390x",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:redis7-7.0.8-150500.3.15.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:redis7-7.0.8-150500.3.15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:redis7-7.0.8-150500.3.15.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:redis7-7.0.8-150500.3.15.1.x86_64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.aarch64",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.x86_64",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.aarch64",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.ppc64le",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.s390x",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:redis7-7.0.8-150500.3.15.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:redis7-7.0.8-150500.3.15.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:redis7-7.0.8-150500.3.15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-01-17T14:38:37Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-51741"
    }
  ]
}

SUSE-SU-2025:0161-1

Vulnerability from csaf_suse - Published: 2025-01-17 14:38 - Updated: 2025-01-17 14:38

Summary

Security update for redis7

Severity

Important

Notes

Title of the patch: Security update for redis7

Patchnames: SUSE-2025-161,SUSE-SLE-Module-Server-Applications-15-SP6-2025-161,openSUSE-SLE-15.6-2025-161

CVE-2024-46981

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2024-51741

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.x86_64	—	Vendor Fix

Threats

Impact moderate

References

12 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-security-upd…	self
https://bugzilla.suse.com/1235386	self
https://bugzilla.suse.com/1235387	self
https://www.suse.com/security/cve/CVE-2024-46981/	self
https://www.suse.com/security/cve/CVE-2024-51741/	self
https://www.suse.com/security/cve/CVE-2024-46981	external
https://bugzilla.suse.com/1235387	external
https://www.suse.com/security/cve/CVE-2024-51741	external
https://bugzilla.suse.com/1235386	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for redis7",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for redis7 fixes the following issues:\n\n- CVE-2024-51741: Fixed a bug where malformed ACL selectors can trigger a server panic when accessed. (bsc#1235386)\n- CVE-2024-46981: Fixed a bug where lua scripts can be used to manipulate the garbage collector, leading to remote code execution. (bsc#1235387)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2025-161,SUSE-SLE-Module-Server-Applications-15-SP6-2025-161,openSUSE-SLE-15.6-2025-161",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_0161-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2025:0161-1",
        "url": "https://www.suse.com/support/update/announcement/2025/suse-su-20250161-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2025:0161-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-January/020157.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1235386",
        "url": "https://bugzilla.suse.com/1235386"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1235387",
        "url": "https://bugzilla.suse.com/1235387"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-46981 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-46981/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-51741 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-51741/"
      }
    ],
    "title": "Security update for redis7",
    "tracking": {
      "current_release_date": "2025-01-17T14:38:46Z",
      "generator": {
        "date": "2025-01-17T14:38:46Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2025:0161-1",
      "initial_release_date": "2025-01-17T14:38:46Z",
      "revision_history": [
        {
          "date": "2025-01-17T14:38:46Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis7-7.0.8-150600.8.6.1.aarch64",
                "product": {
                  "name": "redis7-7.0.8-150600.8.6.1.aarch64",
                  "product_id": "redis7-7.0.8-150600.8.6.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis7-7.0.8-150600.8.6.1.i586",
                "product": {
                  "name": "redis7-7.0.8-150600.8.6.1.i586",
                  "product_id": "redis7-7.0.8-150600.8.6.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis7-7.0.8-150600.8.6.1.ppc64le",
                "product": {
                  "name": "redis7-7.0.8-150600.8.6.1.ppc64le",
                  "product_id": "redis7-7.0.8-150600.8.6.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis7-7.0.8-150600.8.6.1.s390x",
                "product": {
                  "name": "redis7-7.0.8-150600.8.6.1.s390x",
                  "product_id": "redis7-7.0.8-150600.8.6.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis7-7.0.8-150600.8.6.1.x86_64",
                "product": {
                  "name": "redis7-7.0.8-150600.8.6.1.x86_64",
                  "product_id": "redis7-7.0.8-150600.8.6.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Server Applications 15 SP6",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Server Applications 15 SP6",
                  "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-server-applications:15:sp6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.6",
                "product": {
                  "name": "openSUSE Leap 15.6",
                  "product_id": "openSUSE Leap 15.6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis7-7.0.8-150600.8.6.1.aarch64 as component of SUSE Linux Enterprise Module for Server Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.aarch64"
        },
        "product_reference": "redis7-7.0.8-150600.8.6.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis7-7.0.8-150600.8.6.1.ppc64le as component of SUSE Linux Enterprise Module for Server Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.ppc64le"
        },
        "product_reference": "redis7-7.0.8-150600.8.6.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis7-7.0.8-150600.8.6.1.s390x as component of SUSE Linux Enterprise Module for Server Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.s390x"
        },
        "product_reference": "redis7-7.0.8-150600.8.6.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis7-7.0.8-150600.8.6.1.x86_64 as component of SUSE Linux Enterprise Module for Server Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.x86_64"
        },
        "product_reference": "redis7-7.0.8-150600.8.6.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis7-7.0.8-150600.8.6.1.aarch64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.aarch64"
        },
        "product_reference": "redis7-7.0.8-150600.8.6.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis7-7.0.8-150600.8.6.1.ppc64le as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.ppc64le"
        },
        "product_reference": "redis7-7.0.8-150600.8.6.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis7-7.0.8-150600.8.6.1.s390x as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.s390x"
        },
        "product_reference": "redis7-7.0.8-150600.8.6.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis7-7.0.8-150600.8.6.1.x86_64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.x86_64"
        },
        "product_reference": "redis7-7.0.8-150600.8.6.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-46981",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-46981"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.aarch64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.ppc64le",
          "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.s390x",
          "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.x86_64",
          "openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.aarch64",
          "openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.ppc64le",
          "openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.s390x",
          "openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-46981",
          "url": "https://www.suse.com/security/cve/CVE-2024-46981"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1235387 for CVE-2024-46981",
          "url": "https://bugzilla.suse.com/1235387"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.x86_64",
            "openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.aarch64",
            "openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.ppc64le",
            "openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.s390x",
            "openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.x86_64",
            "openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.aarch64",
            "openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.ppc64le",
            "openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.s390x",
            "openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-01-17T14:38:46Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-46981"
    },
    {
      "cve": "CVE-2024-51741",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-51741"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem is fixed in Redis 7.2.7 and 7.4.2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.aarch64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.ppc64le",
          "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.s390x",
          "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.x86_64",
          "openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.aarch64",
          "openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.ppc64le",
          "openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.s390x",
          "openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-51741",
          "url": "https://www.suse.com/security/cve/CVE-2024-51741"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1235386 for CVE-2024-51741",
          "url": "https://bugzilla.suse.com/1235386"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.x86_64",
            "openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.aarch64",
            "openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.ppc64le",
            "openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.s390x",
            "openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis7-7.0.8-150600.8.6.1.x86_64",
            "openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.aarch64",
            "openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.ppc64le",
            "openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.s390x",
            "openSUSE Leap 15.6:redis7-7.0.8-150600.8.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-01-17T14:38:46Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-51741"
    }
  ]
}

SUSE-SU-2025:0163-1

Vulnerability from csaf_suse - Published: 2025-01-17 14:39 - Updated: 2025-01-17 14:39

Summary

Security update for redis

Severity

Important

Notes

Title of the patch: Security update for redis

Description of the patch: This update for redis fixes the following issues: - CVE-2024-51741: Fixed a bug where malformed ACL selectors can trigger a server panic when accessed. (bsc#1235386) - CVE-2024-46981: Fixed a bug where lua scripts can be used to manipulate the garbage collector, leading to remote code execution. (bsc#1235387)

Patchnames: SUSE-2025-163,SUSE-SLE-Module-Server-Applications-15-SP6-2025-163,openSUSE-SLE-15.6-2025-163

CVE-2024-46981

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2024-51741

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.x86_64	—	Vendor Fix

Threats

Impact moderate

References

12 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-security-upd…	self
https://bugzilla.suse.com/1235386	self
https://bugzilla.suse.com/1235387	self
https://www.suse.com/security/cve/CVE-2024-46981/	self
https://www.suse.com/security/cve/CVE-2024-51741/	self
https://www.suse.com/security/cve/CVE-2024-46981	external
https://bugzilla.suse.com/1235387	external
https://www.suse.com/security/cve/CVE-2024-51741	external
https://bugzilla.suse.com/1235386	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for redis",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for redis fixes the following issues:\n\n- CVE-2024-51741: Fixed a bug where malformed ACL selectors can trigger a server panic when accessed. (bsc#1235386)\n- CVE-2024-46981: Fixed a bug where lua scripts can be used to manipulate the garbage collector, leading to remote code execution. (bsc#1235387)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2025-163,SUSE-SLE-Module-Server-Applications-15-SP6-2025-163,openSUSE-SLE-15.6-2025-163",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_0163-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2025:0163-1",
        "url": "https://www.suse.com/support/update/announcement/2025/suse-su-20250163-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2025:0163-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-January/020155.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1235386",
        "url": "https://bugzilla.suse.com/1235386"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1235387",
        "url": "https://bugzilla.suse.com/1235387"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-46981 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-46981/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-51741 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-51741/"
      }
    ],
    "title": "Security update for redis",
    "tracking": {
      "current_release_date": "2025-01-17T14:39:59Z",
      "generator": {
        "date": "2025-01-17T14:39:59Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2025:0163-1",
      "initial_release_date": "2025-01-17T14:39:59Z",
      "revision_history": [
        {
          "date": "2025-01-17T14:39:59Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-7.2.4-150600.3.6.1.aarch64",
                "product": {
                  "name": "redis-7.2.4-150600.3.6.1.aarch64",
                  "product_id": "redis-7.2.4-150600.3.6.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-7.2.4-150600.3.6.1.i586",
                "product": {
                  "name": "redis-7.2.4-150600.3.6.1.i586",
                  "product_id": "redis-7.2.4-150600.3.6.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-7.2.4-150600.3.6.1.ppc64le",
                "product": {
                  "name": "redis-7.2.4-150600.3.6.1.ppc64le",
                  "product_id": "redis-7.2.4-150600.3.6.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-7.2.4-150600.3.6.1.s390x",
                "product": {
                  "name": "redis-7.2.4-150600.3.6.1.s390x",
                  "product_id": "redis-7.2.4-150600.3.6.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-7.2.4-150600.3.6.1.x86_64",
                "product": {
                  "name": "redis-7.2.4-150600.3.6.1.x86_64",
                  "product_id": "redis-7.2.4-150600.3.6.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Server Applications 15 SP6",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Server Applications 15 SP6",
                  "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-server-applications:15:sp6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.6",
                "product": {
                  "name": "openSUSE Leap 15.6",
                  "product_id": "openSUSE Leap 15.6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-7.2.4-150600.3.6.1.aarch64 as component of SUSE Linux Enterprise Module for Server Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.aarch64"
        },
        "product_reference": "redis-7.2.4-150600.3.6.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-7.2.4-150600.3.6.1.ppc64le as component of SUSE Linux Enterprise Module for Server Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.ppc64le"
        },
        "product_reference": "redis-7.2.4-150600.3.6.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-7.2.4-150600.3.6.1.s390x as component of SUSE Linux Enterprise Module for Server Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.s390x"
        },
        "product_reference": "redis-7.2.4-150600.3.6.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-7.2.4-150600.3.6.1.x86_64 as component of SUSE Linux Enterprise Module for Server Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.x86_64"
        },
        "product_reference": "redis-7.2.4-150600.3.6.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Server Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-7.2.4-150600.3.6.1.aarch64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.aarch64"
        },
        "product_reference": "redis-7.2.4-150600.3.6.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-7.2.4-150600.3.6.1.ppc64le as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.ppc64le"
        },
        "product_reference": "redis-7.2.4-150600.3.6.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-7.2.4-150600.3.6.1.s390x as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.s390x"
        },
        "product_reference": "redis-7.2.4-150600.3.6.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-7.2.4-150600.3.6.1.x86_64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.x86_64"
        },
        "product_reference": "redis-7.2.4-150600.3.6.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-46981",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-46981"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.aarch64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.ppc64le",
          "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.s390x",
          "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.x86_64",
          "openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.aarch64",
          "openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.ppc64le",
          "openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.s390x",
          "openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-46981",
          "url": "https://www.suse.com/security/cve/CVE-2024-46981"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1235387 for CVE-2024-46981",
          "url": "https://bugzilla.suse.com/1235387"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.x86_64",
            "openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.aarch64",
            "openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.ppc64le",
            "openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.s390x",
            "openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.x86_64",
            "openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.aarch64",
            "openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.ppc64le",
            "openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.s390x",
            "openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-01-17T14:39:59Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-46981"
    },
    {
      "cve": "CVE-2024-51741",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-51741"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem is fixed in Redis 7.2.7 and 7.4.2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.aarch64",
          "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.ppc64le",
          "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.s390x",
          "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.x86_64",
          "openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.aarch64",
          "openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.ppc64le",
          "openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.s390x",
          "openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-51741",
          "url": "https://www.suse.com/security/cve/CVE-2024-51741"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1235386 for CVE-2024-51741",
          "url": "https://bugzilla.suse.com/1235386"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.x86_64",
            "openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.aarch64",
            "openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.ppc64le",
            "openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.s390x",
            "openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.aarch64",
            "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.s390x",
            "SUSE Linux Enterprise Module for Server Applications 15 SP6:redis-7.2.4-150600.3.6.1.x86_64",
            "openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.aarch64",
            "openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.ppc64le",
            "openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.s390x",
            "openSUSE Leap 15.6:redis-7.2.4-150600.3.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-01-17T14:39:59Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-51741"
    }
  ]
}

WID-SEC-W-2025-0017

Vulnerability from csaf_certbund - Published: 2025-01-06 23:00 - Updated: 2025-11-27 23:00

Summary

Redis: Mehrere Schwachstellen

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Redis ist ein In-Memory-Datenstrukturspeicher, der als Datenbank, Cache und Message Broker verwendet wird.

Angriff: Ein Angreifer kann mehrere Schwachstellen in Redis ausnutzen, um beliebigen Programmcode auszuführen oder einen Denial of Service zu verursachen.

Betroffene Betriebssysteme: - Linux

CVE-2024-46981

Affected products

Known affected 17 products

Product	Identifier	Version
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
IBM DataPower Gateway <10.5.0.16 IBM / DataPower Gateway		<10.5.0.16
Gentoo Linux Gentoo	`cpe:/o:gentoo:linux:-`	—
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
IBM DataPower Gateway <10.6.0.4 IBM / DataPower Gateway		<10.6.0.4
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
IBM DataPower Gateway <10.6.3 IBM / DataPower Gateway		<10.6.3
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Open Source Redis <7.4.2 Open Source / Redis		<7.4.2
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—
Red Hat Enterprise Linux Discovery Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:discovery`	Discovery
Open Source Redis <7.2.7 Open Source / Redis		<7.2.7
Open Source Redis <6.2.17 Open Source / Redis		<6.2.17

CVE-2024-51741

Affected products

Known affected 16 products

Product	Identifier	Version
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
IBM DataPower Gateway <10.5.0.16 IBM / DataPower Gateway		<10.5.0.16
Gentoo Linux Gentoo	`cpe:/o:gentoo:linux:-`	—
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—
RESF Rocky Linux RESF	`cpe:/o:resf:rocky_linux:-`	—
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
IBM DataPower Gateway <10.6.0.4 IBM / DataPower Gateway		<10.6.0.4
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
IBM DataPower Gateway <10.6.3 IBM / DataPower Gateway		<10.6.3
SUSE openSUSE SUSE	`cpe:/o:suse:opensuse:-`	—
Open Source Redis <7.4.2 Open Source / Redis		<7.4.2
Amazon Linux 2 Amazon	`cpe:/o:amazon:linux_2:-`	—
Red Hat Enterprise Linux Discovery Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:discovery`	Discovery
Open Source Redis <7.2.7 Open Source / Redis		<7.2.7

References

46 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://github.com/redis/redis/security/advisorie…	external
https://github.com/redis/redis/security/advisorie…	external
https://bodhi.fedoraproject.org/updates/FEDORA-20…	external
https://bodhi.fedoraproject.org/updates/FEDORA-EP…	external
https://bodhi.fedoraproject.org/updates/FEDORA-20…	external
https://bodhi.fedoraproject.org/updates/FEDORA-20…	external
https://bodhi.fedoraproject.org/updates/FEDORA-20…	external
https://bodhi.fedoraproject.org/updates/FEDORA-20…	external
https://bodhi.fedoraproject.org/updates/FEDORA-EP…	external
https://bodhi.fedoraproject.org/updates/FEDORA-EP…	external
https://bodhi.fedoraproject.org/updates/FEDORA-EP…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.opensuse.org/archives/list/security…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://access.redhat.com/errata/RHSA-2025:0400	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://access.redhat.com/errata/RHSA-2025:0399	external
https://access.redhat.com/errata/RHSA-2025:0398	external
https://lists.debian.org/debian-lts-announce/2025…	external
https://access.redhat.com/errata/RHSA-2025:0566	external
https://access.redhat.com/errata/RHSA-2025:0595	external
https://access.redhat.com/errata/RHSA-2025:0640	external
https://linux.oracle.com/errata/ELSA-2025-0595.html	external
https://access.redhat.com/errata/RHSA-2025:0685	external
https://access.redhat.com/errata/RHSA-2025:0689	external
https://access.redhat.com/errata/RHSA-2025:0692	external
https://access.redhat.com/errata/RHSA-2025:0693	external
https://alas.aws.amazon.com/AL2/ALASREDIS6-2025-0…	external
https://linux.oracle.com/errata/ELSA-2025-0692.html	external
https://linux.oracle.com/errata/ELSA-2025-0693.html	external
https://lists.debian.org/debian-security-announce…	external
https://access.redhat.com/errata/RHSA-2025:1249	external
https://errata.build.resf.org/RLSA-2025:0595	external
https://ubuntu.com/security/notices/USN-7359-1	external
https://www.ibm.com/support/pages/node/7230049	external
https://linux.oracle.com/errata/ELSA-2025-7429.html	external
https://lists.opensuse.org/archives/list/security…	external
https://linux.oracle.com/errata/ELSA-2025-11453.html	external
http://linux.oracle.com/errata/ELSA-2025-12008.html	external
https://security.gentoo.org/glsa/202511-05	external
https://linux.oracle.com/errata/ELSA-2025-20926.html	external
https://linux.oracle.com/errata/ELSA-2025-20955.html	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Redis ist ein In-Memory-Datenstrukturspeicher, der als Datenbank, Cache und Message Broker verwendet wird.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Redis ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service zu verursachen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2025-0017 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-0017.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2025-0017 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-0017"
      },
      {
        "category": "external",
        "summary": "redis/redis GitHub Security Advisory GHSA-39h2-x6c4-6w4c vom 2025-01-06",
        "url": "https://github.com/redis/redis/security/advisories/GHSA-39h2-x6c4-6w4c"
      },
      {
        "category": "external",
        "summary": "redis/redis GitHub Security Advisory GHSA-prpq-rh5h-46g9 vom 2025-01-06",
        "url": "https://github.com/redis/redis/security/advisories/GHSA-prpq-rh5h-46g9"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-2025-72FD0442CC vom 2025-01-06",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2025-72fd0442cc"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-EPEL-2025-86E34A5C90 vom 2025-01-08",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-86e34a5c90"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-2025-282DF7372B vom 2025-01-08",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2025-282df7372b"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-2025-B332AFED45 vom 2025-01-08",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2025-b332afed45"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-2025-9ECCDB2C3E vom 2025-01-08",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2025-9eccdb2c3e"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-2025-D6C0319427 vom 2025-01-08",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2025-d6c0319427"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-EPEL-2025-0BF9F68AAA vom 2025-01-08",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-0bf9f68aaa"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-EPEL-2025-57DF67C36A vom 2025-01-08",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-57df67c36a"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-EPEL-2025-66D12EDFBA vom 2025-01-08",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-66d12edfba"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2025:0081-1 vom 2025-01-13",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-January/020099.html"
      },
      {
        "category": "external",
        "summary": "openSUSE Security Update OPENSUSE-SU-2025:14638-1 vom 2025-01-13",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/TGZSR4XROA2QNSJN3D6QEMR3R6FSTFZQ/"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2025:0163-1 vom 2025-01-17",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-January/020155.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2025:0162-1 vom 2025-01-17",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-January/020156.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:0400 vom 2025-01-20",
        "url": "https://access.redhat.com/errata/RHSA-2025:0400"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2025:0161-1 vom 2025-01-17",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-January/020157.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2025:0160-1 vom 2025-01-17",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-January/020158.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:0399 vom 2025-01-20",
        "url": "https://access.redhat.com/errata/RHSA-2025:0399"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:0398 vom 2025-01-20",
        "url": "https://access.redhat.com/errata/RHSA-2025:0398"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DLA-4025 vom 2025-01-20",
        "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00018.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:0566 vom 2025-01-21",
        "url": "https://access.redhat.com/errata/RHSA-2025:0566"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:0595 vom 2025-01-22",
        "url": "https://access.redhat.com/errata/RHSA-2025:0595"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:0640 vom 2025-01-23",
        "url": "https://access.redhat.com/errata/RHSA-2025:0640"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2025-0595 vom 2025-01-24",
        "url": "https://linux.oracle.com/errata/ELSA-2025-0595.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:0685 vom 2025-01-27",
        "url": "https://access.redhat.com/errata/RHSA-2025:0685"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:0689 vom 2025-01-27",
        "url": "https://access.redhat.com/errata/RHSA-2025:0689"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:0692 vom 2025-01-27",
        "url": "https://access.redhat.com/errata/RHSA-2025:0692"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:0693 vom 2025-01-27",
        "url": "https://access.redhat.com/errata/RHSA-2025:0693"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALASREDIS6-2025-011 vom 2025-01-24",
        "url": "https://alas.aws.amazon.com/AL2/ALASREDIS6-2025-011.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2025-0692 vom 2025-01-27",
        "url": "https://linux.oracle.com/errata/ELSA-2025-0692.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2025-0693 vom 2025-01-29",
        "url": "https://linux.oracle.com/errata/ELSA-2025-0693.html"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DSA-5856 vom 2025-01-30",
        "url": "https://lists.debian.org/debian-security-announce/2025/msg00018.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:1249 vom 2025-02-10",
        "url": "https://access.redhat.com/errata/RHSA-2025:1249"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2025:0595 vom 2025-02-13",
        "url": "https://errata.build.resf.org/RLSA-2025:0595"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-7359-1 vom 2025-03-20",
        "url": "https://ubuntu.com/security/notices/USN-7359-1"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7230049 vom 2025-04-03",
        "url": "https://www.ibm.com/support/pages/node/7230049"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2025-7429 vom 2025-05-23",
        "url": "https://linux.oracle.com/errata/ELSA-2025-7429.html"
      },
      {
        "category": "external",
        "summary": "openSUSE Security Update OPENSUSE-SU-2025:15293-1 vom 2025-07-05",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7UB35TLFHFPDDQZN236SKMZKWTI6NBJO/"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2025-11453 vom 2025-07-23",
        "url": "https://linux.oracle.com/errata/ELSA-2025-11453.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2025-12008 vom 2025-07-30",
        "url": "http://linux.oracle.com/errata/ELSA-2025-12008.html"
      },
      {
        "category": "external",
        "summary": "Gentoo Linux Security Advisory GLSA-202511-05 vom 2025-11-25",
        "url": "https://security.gentoo.org/glsa/202511-05"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2025-20926 vom 2025-11-26",
        "url": "https://linux.oracle.com/errata/ELSA-2025-20926.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2025-20955 vom 2025-11-27",
        "url": "https://linux.oracle.com/errata/ELSA-2025-20955.html"
      }
    ],
    "source_lang": "en-US",
    "title": "Redis: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2025-11-27T23:00:00.000+00:00",
      "generator": {
        "date": "2025-11-28T06:42:26.685+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2025-0017",
      "initial_release_date": "2025-01-06T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2025-01-06T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2025-01-08T23:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Fedora aufgenommen"
        },
        {
          "date": "2025-01-13T23:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von SUSE und openSUSE aufgenommen"
        },
        {
          "date": "2025-01-19T23:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von SUSE und Red Hat aufgenommen"
        },
        {
          "date": "2025-01-20T23:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Red Hat und Debian aufgenommen"
        },
        {
          "date": "2025-01-21T23:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-01-22T23:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-01-23T23:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2025-01-26T23:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von Red Hat und Amazon aufgenommen"
        },
        {
          "date": "2025-01-27T23:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2025-01-29T23:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2025-01-30T23:00:00.000+00:00",
          "number": "12",
          "summary": "Neue Updates von Debian aufgenommen"
        },
        {
          "date": "2025-02-10T23:00:00.000+00:00",
          "number": "13",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-02-13T23:00:00.000+00:00",
          "number": "14",
          "summary": "Neue Updates von Rocky Enterprise Software Foundation aufgenommen"
        },
        {
          "date": "2025-03-20T23:00:00.000+00:00",
          "number": "15",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        },
        {
          "date": "2025-04-03T22:00:00.000+00:00",
          "number": "16",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2025-05-25T22:00:00.000+00:00",
          "number": "17",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2025-07-06T22:00:00.000+00:00",
          "number": "18",
          "summary": "Neue Updates von openSUSE aufgenommen"
        },
        {
          "date": "2025-07-22T22:00:00.000+00:00",
          "number": "19",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2025-07-30T22:00:00.000+00:00",
          "number": "20",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2025-11-24T23:00:00.000+00:00",
          "number": "21",
          "summary": "Neue Updates von Gentoo aufgenommen"
        },
        {
          "date": "2025-11-25T23:00:00.000+00:00",
          "number": "22",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2025-11-27T23:00:00.000+00:00",
          "number": "23",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        }
      ],
      "status": "final",
      "version": "23"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Amazon Linux 2",
            "product": {
              "name": "Amazon Linux 2",
              "product_id": "398363",
              "product_identification_helper": {
                "cpe": "cpe:/o:amazon:linux_2:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Amazon"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Debian Linux",
            "product": {
              "name": "Debian Linux",
              "product_id": "2951",
              "product_identification_helper": {
                "cpe": "cpe:/o:debian:debian_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Debian"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Fedora Linux",
            "product": {
              "name": "Fedora Linux",
              "product_id": "74185",
              "product_identification_helper": {
                "cpe": "cpe:/o:fedoraproject:fedora:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Fedora"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Gentoo Linux",
            "product": {
              "name": "Gentoo Linux",
              "product_id": "T012167",
              "product_identification_helper": {
                "cpe": "cpe:/o:gentoo:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Gentoo"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c10.6.0.4",
                "product": {
                  "name": "IBM DataPower Gateway \u003c10.6.0.4",
                  "product_id": "T042113"
                }
              },
              {
                "category": "product_version",
                "name": "10.6.0.4",
                "product": {
                  "name": "IBM DataPower Gateway 10.6.0.4",
                  "product_id": "T042113-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:datapower_gateway:10.6.0.4"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c10.6.3",
                "product": {
                  "name": "IBM DataPower Gateway \u003c10.6.3",
                  "product_id": "T042328"
                }
              },
              {
                "category": "product_version",
                "name": "10.6.3",
                "product": {
                  "name": "IBM DataPower Gateway 10.6.3",
                  "product_id": "T042328-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:datapower_gateway:10.6.3"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c10.5.0.16",
                "product": {
                  "name": "IBM DataPower Gateway \u003c10.5.0.16",
                  "product_id": "T042329"
                }
              },
              {
                "category": "product_version",
                "name": "10.5.0.16",
                "product": {
                  "name": "IBM DataPower Gateway 10.5.0.16",
                  "product_id": "T042329-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:datapower_gateway:10.5.0.16"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "DataPower Gateway"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c6.2.17",
                "product": {
                  "name": "Open Source Redis \u003c6.2.17",
                  "product_id": "T040026"
                }
              },
              {
                "category": "product_version",
                "name": "6.2.17",
                "product": {
                  "name": "Open Source Redis 6.2.17",
                  "product_id": "T040026-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redislabs:redis:6.2.17"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c7.2.7",
                "product": {
                  "name": "Open Source Redis \u003c7.2.7",
                  "product_id": "T040027"
                }
              },
              {
                "category": "product_version",
                "name": "7.2.7",
                "product": {
                  "name": "Open Source Redis 7.2.7",
                  "product_id": "T040027-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redislabs:redis:7.2.7"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c7.4.2",
                "product": {
                  "name": "Open Source Redis \u003c7.4.2",
                  "product_id": "T040028"
                }
              },
              {
                "category": "product_version",
                "name": "7.4.2",
                "product": {
                  "name": "Open Source Redis 7.4.2",
                  "product_id": "T040028-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redislabs:redis:7.4.2"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Redis"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Oracle Linux",
            "product": {
              "name": "Oracle Linux",
              "product_id": "T004914",
              "product_identification_helper": {
                "cpe": "cpe:/o:oracle:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "RESF Rocky Linux",
            "product": {
              "name": "RESF Rocky Linux",
              "product_id": "T032255",
              "product_identification_helper": {
                "cpe": "cpe:/o:resf:rocky_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "RESF"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux",
                "product": {
                  "name": "Red Hat Enterprise Linux",
                  "product_id": "67646",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:-"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Discovery",
                "product": {
                  "name": "Red Hat Enterprise Linux Discovery",
                  "product_id": "T040951",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:discovery"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Enterprise Linux"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T002207",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "SUSE openSUSE",
            "product": {
              "name": "SUSE openSUSE",
              "product_id": "T027843",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:opensuse:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Ubuntu Linux",
            "product": {
              "name": "Ubuntu Linux",
              "product_id": "T000126",
              "product_identification_helper": {
                "cpe": "cpe:/o:canonical:ubuntu_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Ubuntu"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-46981",
      "product_status": {
        "known_affected": [
          "67646",
          "T042329",
          "T012167",
          "T004914",
          "T032255",
          "74185",
          "T042113",
          "2951",
          "T002207",
          "T000126",
          "T042328",
          "T027843",
          "T040028",
          "398363",
          "T040951",
          "T040027",
          "T040026"
        ]
      },
      "release_date": "2025-01-06T23:00:00.000+00:00",
      "title": "CVE-2024-46981"
    },
    {
      "cve": "CVE-2024-51741",
      "product_status": {
        "known_affected": [
          "67646",
          "T042329",
          "T012167",
          "T004914",
          "T032255",
          "74185",
          "T042113",
          "2951",
          "T002207",
          "T000126",
          "T042328",
          "T027843",
          "T040028",
          "398363",
          "T040951",
          "T040027"
        ]
      },
      "release_date": "2025-01-06T23:00:00.000+00:00",
      "title": "CVE-2024-51741"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-51741 (GCVE-0-2024-51741)

RHSA-2025:0692

SUSE-SU-2025:0160-1

SUSE-SU-2025:0161-1

SUSE-SU-2025:0163-1

WID-SEC-W-2025-0017

Tags

Sightings

Nomenclature