CVE-2022-24736— Redis Labs Redis 代码问题漏洞

A Malformed Lua script can crash Redis

Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. The problem is fixed in Redis versions 7.0.0 and 6.2.7. An additional workaround to mitigate this problem without patching the redis-server executable, if Lua scripting is not being used, is to block access to `SCRIPT LOAD` and `EVAL` commands using ACL rules.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

空指针解引用

Redis Labs Redis 代码问题漏洞

Redis Labs Redis是美国Redis Labs公司的一套开源的使用ANSI C编写、支持网络、可基于内存亦可持久化的日志型、键值（Key-Value）存储数据库，并提供多种语言的API。 Redis 6.2.7 版本之前和 7.0.0 版本之前存在安全漏洞，尝试加载特制 Lua 脚本的攻击者可能会通过NULL指针取消引用来利用该漏洞导致redis-server进程崩溃。

N/A

N/A