CVE-2024-46981

Fixed in a distro release EPSS 8%CVSS 7.0

Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

Published 2025-01-06 · CVE record · OSV

Products: Redis

Distro releases

Release	Package	Fixed in
AlmaLinux:8	redis	6.2.17-1.module_el8.10.0+3946+3de613d5
AlmaLinux:8	redis-devel	6.2.17-1.module_el8.10.0+3946+3de613d5
AlmaLinux:8	redis-doc	6.2.17-1.module_el8.10.0+3946+3de613d5
AlmaLinux:9	redis	7.2.7-1.module_el9.5.0+134+2e645600
AlmaLinux:9	redis	6.2.17-1.el9_5
AlmaLinux:9	redis-devel	7.2.7-1.module_el9.5.0+134+2e645600
AlmaLinux:9	redis-devel	6.2.17-1.el9_5
AlmaLinux:9	redis-doc	7.2.7-1.module_el9.5.0+134+2e645600
AlmaLinux:9	redis-doc	6.2.17-1.el9_5
Alpine:v3.15	redis	6.2.18-r0
Alpine:v3.18	redis	7.0.15-r2
Alpine:v3.19	redis	7.2.7-r0
Alpine:v3.20	valkey	7.2.8-r0
Alpine:v3.21	valkey	7.2.8-r0
Alpine:v3.22	valkey	7.2.8-r0
Alpine:v3.23	valkey	7.2.8-r0
Alpine:v3.24	valkey	7.2.8-r0
Chainguard	py3-redis	0
Chainguard	py3.10-redis	0
Chainguard	py3.11-redis	0
Chainguard	py3.12-redis	0
Chainguard	py3.13-redis	0
Chainguard	redis-6.2	6.2.17-r0
Chainguard	redis-6.2-bitnami-compat	6.2.17-r0
Chainguard	redis-7.2	7.2.7-r0
Chainguard	redis-7.2-bitnami-compat	7.2.7-r0
Chainguard	redis-7.2-iamguarded-compat	7.2.12-r2
Chainguard	redis-7.4	7.4.2-r0
Chainguard	redis-7.4-bitnami-compat	7.4.2-r0
Chainguard	redis-benchmark-6.2	6.2.17-r0
Chainguard	redis-benchmark-7.2	7.2.7-r0
Chainguard	redis-benchmark-7.2	7.2.12-r2
Chainguard	redis-benchmark-7.4	7.4.2-r0
Chainguard	redis-cli-6.2	6.2.17-r0
Chainguard	redis-cli-7.2	7.2.7-r0
Chainguard	redis-cli-7.2	7.2.12-r2
Chainguard	redis-cli-7.4	7.4.2-r0
Chainguard	redis-cluster-6.2-bitnami-compat	6.2.17-r0
Chainguard	redis-cluster-7.2-bitnami-compat	7.2.7-r0
Chainguard	redis-cluster-7.2-iamguarded-compat	7.2.12-r2
Chainguard	redis-cluster-7.4-bitnami-compat	7.4.2-r0
Chainguard	redis-sentinel-6.2-bitnami-compat	6.2.17-r0
Chainguard	redis-sentinel-7.2-bitnami-compat	7.2.7-r0
Chainguard	redis-sentinel-7.2-iamguarded-compat	7.2.12-r2
Chainguard	redis-sentinel-7.4-bitnami-compat	7.4.2-r0
Debian:11	redis	5:6.0.16-1+deb11u5
Debian:12	redis	5:7.0.15-1~deb12u3
Debian:13	redis	5:7.0.15-3
Debian:13	valkey	8.0.2+dfsg1-1
Debian:14	redict	7.3.2+ds-1
Debian:14	redis	5:7.0.15-3
Debian:14	valkey	8.0.2+dfsg1-1
Red Hat:enterprise_linux:8	redis	0:6.2.17-1.module+el8.10.0+22680+748527fd
Red Hat:enterprise_linux:8	redis-debuginfo	0:6.2.17-1.module+el8.10.0+22680+748527fd
Red Hat:enterprise_linux:8	redis-debugsource	0:6.2.17-1.module+el8.10.0+22680+748527fd
Red Hat:enterprise_linux:8	redis-devel	0:6.2.17-1.module+el8.10.0+22680+748527fd
Red Hat:enterprise_linux:8	redis-doc	0:6.2.17-1.module+el8.10.0+22680+748527fd
Red Hat:enterprise_linux:9	redis	0:6.2.17-1.el9_5
Red Hat:enterprise_linux:9	redis	0:7.2.7-1.module+el9.5.0+22705+3d861c1c
Red Hat:enterprise_linux:9	redis-debuginfo	0:7.2.7-1.module+el9.5.0+22705+3d861c1c
Red Hat:enterprise_linux:9	redis-debuginfo	0:6.2.17-1.el9_5
Red Hat:enterprise_linux:9	redis-debugsource	0:6.2.17-1.el9_5
Red Hat:enterprise_linux:9	redis-debugsource	0:7.2.7-1.module+el9.5.0+22705+3d861c1c
Red Hat:enterprise_linux:9	redis-devel	0:7.2.7-1.module+el9.5.0+22705+3d861c1c
Red Hat:enterprise_linux:9	redis-devel	0:6.2.17-1.el9_5
Red Hat:enterprise_linux:9	redis-doc	0:7.2.7-1.module+el9.5.0+22705+3d861c1c
Red Hat:enterprise_linux:9	redis-doc	0:6.2.17-1.el9_5
Red Hat:rhel_aus:8.4	redis	0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1
Red Hat:rhel_aus:8.4	redis-debuginfo	0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1
Red Hat:rhel_aus:8.4	redis-debugsource	0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1
Red Hat:rhel_aus:8.4	redis-devel	0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1
Red Hat:rhel_aus:8.4	redis-doc	0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1
Red Hat:rhel_aus:8.6	redis	0:6.0.9-5.module+el8.6.0+22735+5bedcf81.1
Red Hat:rhel_aus:8.6	redis-debuginfo	0:6.0.9-5.module+el8.6.0+22735+5bedcf81.1
Red Hat:rhel_aus:8.6	redis-debugsource	0:6.0.9-5.module+el8.6.0+22735+5bedcf81.1
Red Hat:rhel_aus:8.6	redis-devel	0:6.0.9-5.module+el8.6.0+22735+5bedcf81.1
Red Hat:rhel_aus:8.6	redis-doc	0:6.0.9-5.module+el8.6.0+22735+5bedcf81.1
Red Hat:rhel_e4s:8.4	redis	0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1
Red Hat:rhel_e4s:8.4	redis-debuginfo	0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1
Red Hat:rhel_e4s:8.4	redis-debugsource	0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1
Red Hat:rhel_e4s:8.4	redis-devel	0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1
Red Hat:rhel_e4s:8.4	redis-doc	0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1
Red Hat:rhel_e4s:8.6	redis	0:6.0.9-5.module+el8.6.0+22735+5bedcf81.1
Red Hat:rhel_e4s:8.6	redis-debuginfo	0:6.0.9-5.module+el8.6.0+22735+5bedcf81.1
Red Hat:rhel_e4s:8.6	redis-debugsource	0:6.0.9-5.module+el8.6.0+22735+5bedcf81.1
Red Hat:rhel_e4s:8.6	redis-devel	0:6.0.9-5.module+el8.6.0+22735+5bedcf81.1
Red Hat:rhel_e4s:8.6	redis-doc	0:6.0.9-5.module+el8.6.0+22735+5bedcf81.1
Red Hat:rhel_e4s:9.0	redis	0:6.2.6-1.el9_0.1
Red Hat:rhel_e4s:9.0	redis-debuginfo	0:6.2.6-1.el9_0.1
Red Hat:rhel_e4s:9.0	redis-debugsource	0:6.2.6-1.el9_0.1
Red Hat:rhel_e4s:9.0	redis-devel	0:6.2.6-1.el9_0.1
Red Hat:rhel_e4s:9.0	redis-doc	0:6.2.6-1.el9_0.1
Red Hat:rhel_eus:8.8	redis	0:6.2.7-1.module+el8.8.0+22725+e1c935f8.1
Red Hat:rhel_eus:8.8	redis-debuginfo	0:6.2.7-1.module+el8.8.0+22725+e1c935f8.1
Red Hat:rhel_eus:8.8	redis-debugsource	0:6.2.7-1.module+el8.8.0+22725+e1c935f8.1
Red Hat:rhel_eus:8.8	redis-devel	0:6.2.7-1.module+el8.8.0+22725+e1c935f8.1
Red Hat:rhel_eus:8.8	redis-doc	0:6.2.7-1.module+el8.8.0+22725+e1c935f8.1
Red Hat:rhel_eus:9.2	redis	0:6.2.7-1.el9_2.1
Red Hat:rhel_eus:9.2	redis-debuginfo	0:6.2.7-1.el9_2.1
Red Hat:rhel_eus:9.2	redis-debugsource	0:6.2.7-1.el9_2.1
Red Hat:rhel_eus:9.2	redis-devel	0:6.2.7-1.el9_2.1
Red Hat:rhel_eus:9.2	redis-doc	0:6.2.7-1.el9_2.1
Red Hat:rhel_eus:9.4	redis	0:7.0.12-1.module+el9.4.0+22724+5f7cf862.2
Red Hat:rhel_eus:9.4	redis	0:6.2.7-1.el9_4.1
Red Hat:rhel_eus:9.4	redis-debuginfo	0:7.0.12-1.module+el9.4.0+22724+5f7cf862.2
Red Hat:rhel_eus:9.4	redis-debuginfo	0:6.2.7-1.el9_4.1
Red Hat:rhel_eus:9.4	redis-debugsource	0:7.0.12-1.module+el9.4.0+22724+5f7cf862.2
Red Hat:rhel_eus:9.4	redis-debugsource	0:6.2.7-1.el9_4.1
Red Hat:rhel_eus:9.4	redis-devel	0:6.2.7-1.el9_4.1
Red Hat:rhel_eus:9.4	redis-devel	0:7.0.12-1.module+el9.4.0+22724+5f7cf862.2
Red Hat:rhel_eus:9.4	redis-doc	0:6.2.7-1.el9_4.1
Red Hat:rhel_eus:9.4	redis-doc	0:7.0.12-1.module+el9.4.0+22724+5f7cf862.2
Red Hat:rhel_tus:8.4	redis	0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1
Red Hat:rhel_tus:8.4	redis-debuginfo	0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1
Red Hat:rhel_tus:8.4	redis-debugsource	0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1
Red Hat:rhel_tus:8.4	redis-devel	0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1
Red Hat:rhel_tus:8.4	redis-doc	0:6.0.9-5.module+el8.4.0+22739+cf3cc450.1
Red Hat:rhel_tus:8.6	redis	0:6.0.9-5.module+el8.6.0+22735+5bedcf81.1
Red Hat:rhel_tus:8.6	redis-debuginfo	0:6.0.9-5.module+el8.6.0+22735+5bedcf81.1
Red Hat:rhel_tus:8.6	redis-debugsource	0:6.0.9-5.module+el8.6.0+22735+5bedcf81.1
Red Hat:rhel_tus:8.6	redis-devel	0:6.0.9-5.module+el8.6.0+22735+5bedcf81.1
Red Hat:rhel_tus:8.6	redis-doc	0:6.0.9-5.module+el8.6.0+22735+5bedcf81.1
Rocky Linux:8	redis	0:6.2.17-1.module+el8.10.0+1923+5b85c6a7
Rocky Linux:9	redis	0:7.2.7-1.module+el9.5.0+30204+5d6debe1
Rocky Linux:9	redis	0:6.2.17-1.el9_5
SUSE:Enterprise Storage 7.1	redis	6.0.14-150200.6.32.1
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS	redis	6.0.14-150200.6.32.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS	redis	6.2.6-150400.3.31.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS	redis	6.2.6-150400.3.31.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS	redis	6.2.6-150400.3.31.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS	redis7	7.0.8-150500.3.15.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS	redis	6.2.6-150400.3.31.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS	redis7	7.0.8-150500.3.15.1
SUSE:Linux Enterprise Module for Server Applications 15 SP6	redis	7.2.4-150600.3.6.1
SUSE:Linux Enterprise Module for Server Applications 15 SP6	redis7	7.0.8-150600.8.6.1
SUSE:Linux Enterprise Server 15 SP3-LTSS	redis	6.0.14-150200.6.32.1
SUSE:Linux Enterprise Server 15 SP4-LTSS	redis	6.2.6-150400.3.31.1
SUSE:Linux Enterprise Server 15 SP5-LTSS	redis	6.2.6-150400.3.31.1
SUSE:Linux Enterprise Server 15 SP5-LTSS	redis7	7.0.8-150500.3.15.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP3	redis	6.0.14-150200.6.32.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4	redis	6.2.6-150400.3.31.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5	redis	6.2.6-150400.3.31.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5	redis7	7.0.8-150500.3.15.1
SUSE:Manager Proxy 4.3	redis	6.2.6-150400.3.31.1
SUSE:Manager Server 4.3	redis	6.2.6-150400.3.31.1
Ubuntu:24.04:LTS	redis	5:7.0.15-1ubuntu0.24.04.1
Ubuntu:24.04:LTS	valkey	7.2.8+dfsg1-0ubuntu0.24.04.2
Ubuntu:25.10	redict	no fix
Ubuntu:26.04:LTS	redict	no fix
Ubuntu:26.10	redict	no fix
Ubuntu:Pro:14.04:LTS	redis	2:2.8.4-2ubuntu0.2+esm4
Ubuntu:Pro:16.04:LTS	redis	2:3.0.6-1ubuntu0.4+esm3
Ubuntu:Pro:18.04:LTS	redis	5:4.0.9-1ubuntu0.2+esm5
Ubuntu:Pro:20.04:LTS	redis	5:5.0.7-2ubuntu0.1+esm3
Ubuntu:Pro:22.04:LTS	redis	5:6.0.16-1ubuntu1+esm2
Wolfi	redis-6.2	6.2.17-r0
Wolfi	redis-7.2	7.2.7-r0
Wolfi	redis-7.4	7.4.2-r0
Wolfi	redis-benchmark-7.2	7.2.12-r2
Wolfi	redis-cli-7.2	7.2.12-r2
openSUSE:Leap 15.6	redis	7.2.4-150600.3.6.1
openSUSE:Leap 15.6	redis7	7.0.8-150600.8.6.1
openSUSE:Tumbleweed	redis	8.0.2-1.1
openSUSE:Tumbleweed	valkey	8.0.2-1.1