CVE-2024-31227
Fixed in a distro release EPSS <1%CVSS 4.4
Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem exists in Redis 7 prior to versions 7.2.6 and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Products: Redis
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 9 | redis | 7.2.6-1.module_el9.5.0+130+36ae7635 |
| AlmaLinux 9 | redis-devel | 7.2.6-1.module_el9.5.0+130+36ae7635 |
| AlmaLinux 9 | redis-doc | 7.2.6-1.module_el9.5.0+130+36ae7635 |
| Alpine 3.17 | redis | 7.0.15-r1 |
| Alpine 3.18 | redis | 7.0.15-r1 |
| Alpine 3.19 | redis | 7.2.4-r1 |
| Alpine 3.20 | valkey | 7.2.7-r0 |
| Alpine 3.21 | valkey | 7.2.7-r0 |
| Alpine 3.22 | valkey | 7.2.7-r0 |
| Alpine 3.23 | valkey | 7.2.7-r0 |
| Alpine 3.24 | valkey | 7.2.7-r0 |
| Chainguard | py3-redis | 0 |
| Chainguard | py3.10-redis | 0 |
| Chainguard | py3.11-redis | 0 |
| Chainguard | py3.12-redis | 0 |
| Chainguard | py3.13-redis | 0 |
| Chainguard | redis-7.2 | 7.2.6-r0 |
| Chainguard | redis-7.2-iamguarded-compat | 7.2.12-r2 |
| Chainguard | redis-7.4 | 7.4.1-r0 |
| Chainguard | redis-benchmark-7.2 | 7.2.12-r2 |
| Chainguard | redis-cli-7.2 | 7.2.12-r2 |
| Chainguard | redis-cluster-7.2-iamguarded-compat | 7.2.12-r2 |
| Chainguard | redis-sentinel-7.2-iamguarded-compat | 7.2.12-r2 |
| Debian 12 | redis | 5:7.0.15-1~deb12u2 |
| Debian 13 | redis | 5:7.0.15-2 |
| Debian 13 | valkey | 8.0.1+dfsg1-1 |
| Debian 14 | redict | 7.3.1+ds-1 |
| Debian 14 | redis | 5:7.0.15-2 |
| Debian 14 | valkey | 8.0.1+dfsg1-1 |
| Red Hat Enterprise Linux 9 | redis | 0:7.2.6-1.module+el9.5.0+22422+63e067d8 |
| Red Hat Enterprise Linux 9 | redis-debuginfo | 0:7.2.6-1.module+el9.5.0+22422+63e067d8 |
| Red Hat Enterprise Linux 9 | redis-debugsource | 0:7.2.6-1.module+el9.5.0+22422+63e067d8 |
| Red Hat Enterprise Linux 9 | redis-devel | 0:7.2.6-1.module+el9.5.0+22422+63e067d8 |
| Red Hat Enterprise Linux 9 | redis-doc | 0:7.2.6-1.module+el9.5.0+22422+63e067d8 |
| SUSE Linux Enterprise Module for Server Applications 15 SP5 | redis7 | 7.0.8-150500.3.12.1 |
| SUSE Linux Enterprise Module for Server Applications 15 SP6 | redis | 7.2.4-150600.3.3.1 |
| SUSE Linux Enterprise Module for Server Applications 15 SP6 | redis7 | 7.0.8-150600.8.3.1 |
| Ubuntu 24.04 LTS | redis | no fix |
| Wolfi | redis-7.2 | 7.2.6-r0 |
| Wolfi | redis-7.4 | 7.4.1-r0 |
| Wolfi | redis-benchmark-7.2 | 7.2.12-r2 |
| Wolfi | redis-cli-7.2 | 7.2.12-r2 |
| openSUSE Leap 15.5 | redis7 | 7.0.8-150500.3.12.1 |
| openSUSE Leap 15.6 | redis | 7.2.4-150600.3.3.1 |
| openSUSE Leap 15.6 | redis7 | 7.0.8-150600.8.3.1 |
| openSUSE Tumbleweed | redis | 8.0.2-1.1 |
| openSUSE Tumbleweed | valkey | 8.0.1-1.1 |