CVE-2022-24736

描述

Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. The problem is fixed in Redis versions 7.0.0 and 6.2.7. An additional workaround to mitigate this problem without patching the redis-server executable, if Lua scripting is not being used, is to block access to `SCRIPT LOAD` and `EVAL` commands using ACL rules.

如何修補 CVE-2022-24736

要修補 CVE-2022-24736,請將受影響套件升級到下列已修補版本。

• —升級至 6.2.7-r0 或更新版本
• —升級至 6.2.7 或更新版本
• —升級至 6.2.7 或更新版本
• —升級至 6.2.7 或更新版本
• —未列出修補版本

CVE-2022-24736 正在被利用嗎?

低 — EPSS 為 1.5%,目前沒有觀察到大規模利用活動。

受影響套件(5)

• from 0, < 6.2.7-r0
• from 0, < 6.2.7
• from 0, < 6.2.7
• from 0, < 6.2.7
• from 0

CVSS 分數

參考連結(13)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2022-24736
• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2022-24736
• WEBgithub.com/redis/redis/pull/10651
• WEBgithub.com/redis/redis/releases/tag/6.2.7
• WEB