CVE-2024-31449

Fixed in a distro release EPSS 4%CVSS 7.0

Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Published 2024-10-07 · CVE record · OSV

Products: Redis

Distro releases

Release	Package	Fixed in
AlmaLinux 8	redis	6.2.17-1.module_el8.10.0+3946+3de613d5
AlmaLinux 8	redis-devel	6.2.17-1.module_el8.10.0+3946+3de613d5
AlmaLinux 8	redis-doc	6.2.17-1.module_el8.10.0+3946+3de613d5
AlmaLinux 9	redis	7.2.6-1.module_el9.5.0+130+36ae7635
AlmaLinux 9	redis	6.2.17-1.el9_5
AlmaLinux 9	redis-devel	7.2.6-1.module_el9.5.0+130+36ae7635
AlmaLinux 9	redis-devel	6.2.17-1.el9_5
AlmaLinux 9	redis-doc	7.2.6-1.module_el9.5.0+130+36ae7635
AlmaLinux 9	redis-doc	6.2.17-1.el9_5
Alpine 3.15	redis	6.2.18-r0
Alpine 3.17	redis	7.0.15-r1
Alpine 3.18	redis	7.0.15-r1
Alpine 3.19	redis	7.2.4-r1
Alpine 3.20	valkey	7.2.7-r0
Alpine 3.21	valkey	7.2.7-r0
Alpine 3.22	valkey	7.2.7-r0
Alpine 3.23	valkey	7.2.7-r0
Alpine 3.24	valkey	7.2.7-r0
Chainguard	py3-redis	0
Chainguard	py3.10-redis	0
Chainguard	py3.11-redis	0
Chainguard	py3.12-redis	0
Chainguard	py3.13-redis	0
Chainguard	redis-6.2	6.2.16-r0
Chainguard	redis-6.2-bitnami-compat	6.2.16-r0
Chainguard	redis-7.2	7.2.6-r0
Chainguard	redis-7.2-iamguarded-compat	7.2.12-r2
Chainguard	redis-7.4	7.4.1-r0
Chainguard	redis-benchmark-6.2	6.2.16-r0
Chainguard	redis-benchmark-7.2	7.2.12-r2
Chainguard	redis-cli-6.2	6.2.16-r0
Chainguard	redis-cli-7.2	7.2.12-r2
Chainguard	redis-cluster-6.2-bitnami-compat	6.2.16-r0
Chainguard	redis-cluster-7.2-iamguarded-compat	7.2.12-r2
Chainguard	redis-sentinel-6.2-bitnami-compat	6.2.16-r0
Chainguard	redis-sentinel-7.2-iamguarded-compat	7.2.12-r2
Debian 12	redis	5:7.0.15-1~deb12u2
Debian 13	redis	5:7.0.15-2
Debian 13	valkey	8.0.1+dfsg1-1
Debian 14	redict	7.3.1+ds-1
Debian 14	redis	5:7.0.15-2
Debian 14	valkey	8.0.1+dfsg1-1
Red Hat Enterprise Linux 8	redis	0:6.2.17-1.module+el8.10.0+22680+748527fd
Red Hat Enterprise Linux 8	redis-debuginfo	0:6.2.17-1.module+el8.10.0+22680+748527fd
Red Hat Enterprise Linux 8	redis-debugsource	0:6.2.17-1.module+el8.10.0+22680+748527fd
Red Hat Enterprise Linux 8	redis-devel	0:6.2.17-1.module+el8.10.0+22680+748527fd
Red Hat Enterprise Linux 8	redis-doc	0:6.2.17-1.module+el8.10.0+22680+748527fd
Red Hat Enterprise Linux 9	redis	0:6.2.17-1.el9_5
Red Hat Enterprise Linux 9	redis	0:7.2.6-1.module+el9.5.0+22422+63e067d8
Red Hat Enterprise Linux 9	redis-debuginfo	0:7.2.6-1.module+el9.5.0+22422+63e067d8
Red Hat Enterprise Linux 9	redis-debuginfo	0:6.2.17-1.el9_5
Red Hat Enterprise Linux 9	redis-debugsource	0:6.2.17-1.el9_5
Red Hat Enterprise Linux 9	redis-debugsource	0:7.2.6-1.module+el9.5.0+22422+63e067d8
Red Hat Enterprise Linux 9	redis-devel	0:7.2.6-1.module+el9.5.0+22422+63e067d8
Red Hat Enterprise Linux 9	redis-devel	0:6.2.17-1.el9_5
Red Hat Enterprise Linux 9	redis-doc	0:6.2.17-1.el9_5
Red Hat Enterprise Linux 9	redis-doc	0:7.2.6-1.module+el9.5.0+22422+63e067d8
Rocky Linux 8	redis	0:6.2.17-1.module+el8.10.0+1923+5b85c6a7
Rocky Linux 9	redis	0:6.2.17-1.el9_5
SUSE Enterprise Storage 7.1	redis	6.0.14-150200.6.32.1
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS	redis	6.0.14-150200.6.32.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	redis	6.2.6-150400.3.28.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	redis	6.2.6-150400.3.28.1
SUSE Linux Enterprise Module for Server Applications 15 SP5	redis	6.2.6-150400.3.28.1
SUSE Linux Enterprise Module for Server Applications 15 SP5	redis7	7.0.8-150500.3.12.1
SUSE Linux Enterprise Module for Server Applications 15 SP6	redis	7.2.4-150600.3.3.1
SUSE Linux Enterprise Module for Server Applications 15 SP6	redis7	7.0.8-150600.8.3.1
SUSE Linux Enterprise Server 15 SP3-LTSS	redis	6.0.14-150200.6.32.1
SUSE Linux Enterprise Server 15 SP4-LTSS	redis	6.2.6-150400.3.28.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3	redis	6.0.14-150200.6.32.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4	redis	6.2.6-150400.3.28.1
SUSE Manager Proxy 4.3	redis	6.2.6-150400.3.28.1
SUSE Manager Server 4.3	redis	6.2.6-150400.3.28.1
Ubuntu 16.04 LTS	lua-bitop	no fix
Ubuntu 18.04 LTS	lua-bitop	no fix
Ubuntu 24.04 LTS	lua-bitop	no fix
Ubuntu 24.04 LTS	redis	5:7.0.15-1ubuntu0.24.04.4
Ubuntu 25.10	lua-bitop	no fix
Ubuntu 26.04 LTS	lua-bitop	no fix
Ubuntu 26.10	lua-bitop	no fix
Ubuntu Pro 16.04 LTS	redis	2:3.0.6-1ubuntu0.4+esm5
Ubuntu Pro 18.04 LTS	redis	5:4.0.9-1ubuntu0.2+esm7
Ubuntu Pro 20.04 LTS	lua-bitop	1.0.2-5ubuntu0.20.04.1~esm2
Ubuntu Pro 20.04 LTS	lua-cjson	2.1.0+dfsg-2.1ubuntu0.20.04.1~esm2
Ubuntu Pro 20.04 LTS	lua5.1	5.1.5-8.1ubuntu0.20.04.1~esm1
Ubuntu Pro 22.04 LTS	lua-bitop	1.0.2-5ubuntu0.22.04.1~esm2
Ubuntu Pro 22.04 LTS	lua-cjson	2.1.0+dfsg-2.1ubuntu0.22.04.1~esm2
Ubuntu Pro 22.04 LTS	lua5.1	5.1.5-8.1ubuntu0.22.04.1~esm1
Wolfi	redis-6.2	6.2.16-r0
Wolfi	redis-7.2	7.2.6-r0
Wolfi	redis-7.4	7.4.1-r0
Wolfi	redis-benchmark-7.2	7.2.12-r2
Wolfi	redis-cli-7.2	7.2.12-r2
openSUSE Leap 15.5	redis	6.2.6-150400.3.28.1
openSUSE Leap 15.5	redis7	7.0.8-150500.3.12.1
openSUSE Leap 15.6	redis	7.2.4-150600.3.3.1
openSUSE Leap 15.6	redis7	7.0.8-150600.8.3.1
openSUSE Tumbleweed	redis	8.0.2-1.1
openSUSE Tumbleweed	valkey	8.0.1-1.1