Issued:
2022-11-15
Updated:
2022-11-15

RHSA-2022:8096 - Security Advisory

Synopsis

Low: redis security and bug fix update

Type/Severity

Security Advisory: Low

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for redis is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.

Security Fix(es):

  • redis: Code injection via Lua script execution environment (CVE-2022-24735)
  • redis: Malformed Lua script can crash Redis (CVE-2022-24736)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 9 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 9 s390x
  • Red Hat Enterprise Linux for Power, little endian 9 ppc64le
  • Red Hat Enterprise Linux for ARM 64 9 aarch64

Fixes

  • BZ - 2080286 - CVE-2022-24735 redis: Code injection via Lua script execution environment
  • BZ - 2080289 - CVE-2022-24736 redis: Malformed Lua script can crash Redis
  • BZ - 2083151 - Rebase to 6.2.7

Red Hat Enterprise Linux for x86_64 9

SRPM
redis-6.2.7-1.el9.src.rpm SHA-256: e3556b66391d134e7252fa290370aaf63c959ea06a2ba6c4b77dc306a4c2583d
x86_64
redis-6.2.7-1.el9.x86_64.rpm SHA-256: bd5c41f0fa051715afefdc4aec3fa801ae303e5d3b5433f994806ff31da25fb3
redis-debuginfo-6.2.7-1.el9.i686.rpm SHA-256: 63750822d865e8b251288e2faa2fa1705ddb533dba09dd8e391ebd3bcf88ccc5
redis-debuginfo-6.2.7-1.el9.x86_64.rpm SHA-256: 8b84c1340d238c182ec978e924e581ca0df1594f84b390bae5fae8744afd15af
redis-debugsource-6.2.7-1.el9.i686.rpm SHA-256: d0692c62bcf893dba150ae4250c0fff39ca9bc75b3e44639e76cca684db74980
redis-debugsource-6.2.7-1.el9.x86_64.rpm SHA-256: 65d01538409238fbac2783b05a03547e316c36138b93266e30ba88cd346ee5f9
redis-devel-6.2.7-1.el9.i686.rpm SHA-256: 35c7bc7d5cee4ba4056b70702f41bee24eeb7eaec28c65cd48d17420361da621
redis-devel-6.2.7-1.el9.x86_64.rpm SHA-256: f859a6e09c3f4738b2acf4ef47ecd76a92db621a2dfa5c29d571d4bda0cb5277
redis-doc-6.2.7-1.el9.noarch.rpm SHA-256: e19a4bd2f97867e3547bab1940e5e03781e521a7d7c474b63a9f8c985a8eeead

Red Hat Enterprise Linux for IBM z Systems 9

SRPM
redis-6.2.7-1.el9.src.rpm SHA-256: e3556b66391d134e7252fa290370aaf63c959ea06a2ba6c4b77dc306a4c2583d
s390x
redis-6.2.7-1.el9.s390x.rpm SHA-256: 6aa1b1fb4391c3082fb3fb86634ed163d98c9f0bc34f5bfb4cbfb121f38c7fe2
redis-debuginfo-6.2.7-1.el9.s390x.rpm SHA-256: 48d63054344415c39ae8ddbef78208dd439ba6772c1feb67396927ca2e6b9c01
redis-debugsource-6.2.7-1.el9.s390x.rpm SHA-256: 60aed47453997af83979b66e0063703b233dabc19300e35216387cb1635f478a
redis-devel-6.2.7-1.el9.s390x.rpm SHA-256: b217d17ac72aa9da51f313062a3d8f4410c90350bf1605c3bf302aafd303863f
redis-doc-6.2.7-1.el9.noarch.rpm SHA-256: e19a4bd2f97867e3547bab1940e5e03781e521a7d7c474b63a9f8c985a8eeead

Red Hat Enterprise Linux for Power, little endian 9

SRPM
redis-6.2.7-1.el9.src.rpm SHA-256: e3556b66391d134e7252fa290370aaf63c959ea06a2ba6c4b77dc306a4c2583d
ppc64le
redis-6.2.7-1.el9.ppc64le.rpm SHA-256: 54875ea7ecff8277cb4ba31638670201545884b5d67d10dc4d57d9bab0b26419
redis-debuginfo-6.2.7-1.el9.ppc64le.rpm SHA-256: ac8df6e08a0eb6b65ed84c7298d5909d935984a10136f1cc857e5d905c954efd
redis-debugsource-6.2.7-1.el9.ppc64le.rpm SHA-256: 23d67894e104d7a975d0cf2d7aad1369e9d9e03cf24a28c8885b53df81f32adb
redis-devel-6.2.7-1.el9.ppc64le.rpm SHA-256: 19e4de75975b2c6cb7cf792760e9bdc433ec56e08e439523888d1bb57268e6b2
redis-doc-6.2.7-1.el9.noarch.rpm SHA-256: e19a4bd2f97867e3547bab1940e5e03781e521a7d7c474b63a9f8c985a8eeead

Red Hat Enterprise Linux for ARM 64 9

SRPM
redis-6.2.7-1.el9.src.rpm SHA-256: e3556b66391d134e7252fa290370aaf63c959ea06a2ba6c4b77dc306a4c2583d
aarch64
redis-6.2.7-1.el9.aarch64.rpm SHA-256: 7b92d44d1d7dfb2a2499c954088e7a56812b31f44256b9d8566adfa0bca56065
redis-debuginfo-6.2.7-1.el9.aarch64.rpm SHA-256: 5f218887f02ca9ac43b2047da06f280f3a2e9b956640eaa9c82027d124b8a16e
redis-debugsource-6.2.7-1.el9.aarch64.rpm SHA-256: 2bf31d3b61cc138d56caae366b1f0f9baf508bd940a5ae83b220917a5734ba3a
redis-devel-6.2.7-1.el9.aarch64.rpm SHA-256: d823cba21836fa2dd21a86ca5786832e2bd93c5dcbf8bc8649da49ab8f31fe17
redis-doc-6.2.7-1.el9.noarch.rpm SHA-256: e19a4bd2f97867e3547bab1940e5e03781e521a7d7c474b63a9f8c985a8eeead

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.