CVE-2022-24736

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-24736
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-24736.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-24736
Aliases
Downstream
ALPINE (1)
AZL (3)
BELL (1)
CLEANSTART (29)
DEBIAN (1)
MGASA (1)
OESA (2)
openSUSE (1)
RHSA (2)
RLSA (2)
SUSE (2)
UBUNTU (1)
Related
ALSA (2)
openSUSE (1)
SUSE (2)
Published
2022-04-27T19:55:10Z
Modified
2026-10-15T10:49:37Z
Severity
  • 3.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
A Malformed Lua script can crash Redis
Details

Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. The problem is fixed in Redis versions 7.0.0 and 6.2.7. An additional workaround to mitigate this problem without patching the redis-server executable, if Lua scripting is not being used, is to block access to SCRIPT LOAD and EVAL commands using ACL rules.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-476"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24736.json"
}
References

Affected packages

Git / github.com/redis/redis

Affected ranges

Type
GIT
Repo
https://github.com/redis/redis
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e6f67092f8d4d81761a60c46011d1ff1dc3c2628
Introduced
d5915a167f696644e210ee85e549c7ceb41b5791
Fixed
d375595d5e3ae2e5c29e6c00a2dc3d60578fd9fc
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "6.2.7"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:redis:redis:7.0:rc1:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "7.0-rc1"
                },
                {
                    "last_affected":  "7.0-rc1"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:redis:redis:7.0:rc2:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "7.0-rc2"
                },
                {
                    "last_affected":  "7.0-rc2"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:redis:redis:7.0:rc3:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "7.0-rc3"
                },
                {
                    "last_affected":  "7.0-rc3"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "original_tag":  "6.2.7",
            "range":  [
                {
                    "fixed":  "e6f67092f8d4d81761a60c46011d1ff1dc3c2628"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "7.0.0",
            "range":  [
                {
                    "fixed":  "d375595d5e3ae2e5c29e6c00a2dc3d60578fd9fc"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

1.*
1.3.6
2.*
2.2-alpha0
2.2-alpha1
2.2-alpha2
2.2-alpha3
2.2-alpha4
2.2-alpha5
2.2-alpha6
2.2.0-rc1
2.3-alpha0
6.*
6.2-rc1
6.2-rc2
6.2-rc3
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.2.5
6.2.6
7.*
7.0-rc1
7.0-rc2
7.0-rc3
v1.*
v1.3.10
v1.3.11
v1.3.7
v1.3.8
v1.3.9
v2.*
v2.0.0-rc1
v2.1.1-watch
Other
vm-playpen

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-24736.json"