Input validation error in Redis - CVE-2024-51741

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU102382

Input validation error in Redis - CVE-2024-51741

Published: January 6, 2025


Vulnerability identifier: #VU102382
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-51741
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when handling ACL selectors. A remote user can create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service.


Affected software

Redis
Valkey
Gentoo Linux
Debian Linux
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
Fedora
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Ubuntu
Server Applications Module
openSUSE Leap
Anolis OS
EasyApache
APEX Cloud Platform for Red Hat OpenShift
IBM DataPower Gateway
redis-tools (Ubuntu package)
redis-server (Ubuntu package)
redis7-debuginfo
redis7
redis7-debugsource
redis (Debian package)
redis-debuginfo
redis
redis-debugsource
redis-doc
redis-devel
valkey-tools (Ubuntu package)
valkey-server (Ubuntu package)
valkey-sentinel (Ubuntu package)
valkey-redis-compat (Ubuntu package)
redict
dev-db/redict
valkey
dev-db/redis
APEX Cloud Platform for Microsoft Azure

How to mitigate CVE-2024-51741

Install updates from vendor's website.

Redis - addressed in versions 7.2.7, 7.4.2
EasyApache - update to 4 25-2
Valkey - addressed in versions 7.2.8, 8.0.2
IBM DataPower Gateway - addressed in versions 10.5.0.16, 10.6.0.4, 10.6.3
redis-tools (Ubuntu package) - addressed in versions Ubuntu Pro, 5:7.0.15-1ubuntu0.24.04.1, 5:7.0.15-1ubuntu0.24.10.1
redis-server (Ubuntu package) - addressed in versions redis-tools, Ubuntu Pro, 5:7.0.15-1ubuntu0.24.04.1, 5:7.0.15-1ubuntu0.24.10.1
APEX Cloud Platform for Microsoft Azure - update to 01.04.01.00
APEX Cloud Platform for Red Hat OpenShift - update to 03.02.04.00
redis7-debuginfo - addressed in versions 7.0.8-150500.3.15.1, 7.0.8-150600.8.6.1
redis7 - addressed in versions 7.0.8-150500.3.15.1, 7.0.8-150600.8.6.1
redis7-debugsource - addressed in versions 7.0.8-150500.3.15.1, 7.0.8-150600.8.6.1
redis (Debian package) - update to 5:7.0.15-1~deb12u3
redis-debuginfo - update to 7.2.4-150600.3.6.1
redis - update to 7.2.4-150600.3.6.1
redis-debugsource - update to 7.2.4-150600.3.6.1
redis-doc - update to 7.2.7-1
redis-devel - update to 7.2.7-1
redis - update to 7.2.7-1
redis - update to 7.2.7-1.fc40
valkey-tools (Ubuntu package) - addressed in versions 7.2.8+dfsg1-0ubuntu0.24.04.2, 7.2.8+dfsg1-0ubuntu0.24.10.2
valkey-server (Ubuntu package) - addressed in versions 7.2.8+dfsg1-0ubuntu0.24.04.2, 7.2.8+dfsg1-0ubuntu0.24.10.2
valkey-sentinel (Ubuntu package) - addressed in versions 7.2.8+dfsg1-0ubuntu0.24.04.2, 7.2.8+dfsg1-0ubuntu0.24.10.2
valkey-redis-compat (Ubuntu package) - addressed in versions 7.2.8+dfsg1-0ubuntu0.24.04.2, 7.2.8+dfsg1-0ubuntu0.24.10.2
redict - addressed in versions 7.3.2-1.el8, 7.3.2-1.el9, 7.3.2-1.fc40, 7.3.2-1.fc41
dev-db/redict - update to 7.3.5
valkey - addressed in versions 8.0.2-1.el8, 8.0.2-1.el9, 8.0.2-1.fc40, 8.0.2-1.fc41
dev-db/redis - update to 8.0.3

External References

Related Security Bulletins