Updated redis packages fix security vulnerabilities
Publication date: 27 Oct 2024Modification date: 27 Oct 2024
Type: security
Affected Mageia releases : 9
CVE: CVE-2024-31227 , CVE-2024-31228 , CVE-2024-31449
Description
An authenticated with sufficient privileges may create a malformed ACL
selector which, when accessed, triggers a server panic and subsequent
denial of service. (CVE-2024-31227)
Authenticated users can trigger a denial-of-service by using specially
crafted, long string match patterns on supported commands such as
`KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST` and ACL
definitions. Matching of extremely long patterns may result in unbounded
recursion, leading to stack overflow and process crash. (CVE-2024-31228)
An authenticated user may use a specially crafted Lua script to trigger
a stack buffer overflow in the bit library, which may potentially lead
to remote code execution. (CVE-2024-31449)
References
- https://bugs.mageia.org/show_bug.cgi?id=33643
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EMP3URK6CE4LGQZ7V2GD23UVMTFM7K46/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-31227
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-31228
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-31449
SRPMS
9/core
- redis-7.0.14-1.1.mga9