MGASA-2024-0340: redis Mageia

Vulnerability summary

MGASA-2024-0340 is a vulnerability in redis Mageia with no CVSS score yet.

Timeline

1. 27-10-2024
   PublishedVulnerability first disclosed.
2. 16-04-2026
   Last modifiedVulnerability information updated.

Description

Updated redis packages fix security vulnerabilities An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. (CVE-2024-31227) Authenticated users can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST` and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crash. (CVE-2024-31228) An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. (CVE-2024-31449)

No weakness data has been published for this record.