CVE-2024-31227

State: PUBLISHED · Published: 2024-10-07 · Updated: 2024-10-07 · Assigner: GitHub_M

Description

Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem exists in Redis 7 prior to versions 7.2.6 and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CWE

CWE-20 — CWE-20: Improper Input Validation

Affected

redis / redis — v=>= 7.0.0, < 7.2.6 [affected]; v=>= 7.3.0, < 7.4.1 [affected]

CVSS

3.1 score=4.4 severity=MEDIUM CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/redis/redis/security/advisories/GHSA-38p4-26x2-vqhh x_refsource_CONFIRM
https://github.com/redis/redis/commit/b351d5a3210e61cc3b22ba38a723d6da8f3c298a x_refsource_MISC

Source

cvelistV5-main/cves/2024/31xxx/CVE-2024-31227.json