CVE-2024-46981

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-46981", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-09-16T16:10:09.018Z", "datePublished": "2025-01-06T21:11:51.687Z", "dateUpdated": "2025-03-19T20:14:35.152Z"}, "containers": {"cna": {"title": "Redis' Lua library commands may lead to remote code execution", "problemTypes": [{"descriptions": [{"cweId": "CWE-416", "lang": "en", "description": "CWE-416: Use After Free", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/redis/redis/security/advisories/GHSA-39h2-x6c4-6w4c", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/redis/redis/security/advisories/GHSA-39h2-x6c4-6w4c"}, {"name": "https://github.com/redis/redis/releases/tag/6.2.17", "tags": ["x_refsource_MISC"], "url": "https://github.com/redis/redis/releases/tag/6.2.17"}, {"name": "https://github.com/redis/redis/releases/tag/7.2.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/redis/redis/releases/tag/7.2.7"}, {"name": "https://github.com/redis/redis/releases/tag/7.4.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/redis/redis/releases/tag/7.4.2"}], "affected": [{"vendor": "redis", "product": "redis", "versions": [{"version": ">= 7.4.0, < 7.4.2", "status": "affected"}, {"version": ">= 7.2.0, < 7.2.7", "status": "affected"}, {"version": "< 6.2.17", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-01-06T21:11:51.687Z"}, "descriptions": [{"lang": "en", "value": "Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands."}], "source": {"advisory": "GHSA-39h2-x6c4-6w4c", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-06T21:41:47.467485Z", "id": "CVE-2024-46981", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-06T21:42:29.135Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-03-19T20:14:35.152Z"}, "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00018.html"}, {"url": "https://www.vicarius.io/vsociety/posts/cve-2024-46981-detect-redis-vulnerability"}, {"url": "https://www.vicarius.io/vsociety/posts/cve-2024-46981-mitigate-redis-vulnerability"}], "title": "CVE Program Container", "x_generator": {"engine": "ADPogram 0.0.1"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00018.html"}, {"url": "https://www.vicarius.io/vsociety/posts/cve-2024-46981-detect-redis-vulnerability"}, {"url": "https://www.vicarius.io/vsociety/posts/cve-2024-46981-mitigate-redis-vulnerability"}], "x_generator": {"engine": "ADPogram 0.0.1"}, "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-03-19T20:14:35.152Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-46981", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-01-06T21:41:47.467485Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-06T21:41:58.543Z"}}], "cna": {"title": "Redis' Lua library commands may lead to remote code execution", "source": {"advisory": "GHSA-39h2-x6c4-6w4c", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "redis", "product": "redis", "versions": [{"status": "affected", "version": ">= 7.4.0, < 7.4.2"}, {"status": "affected", "version": ">= 7.2.0, < 7.2.7"}, {"status": "affected", "version": "< 6.2.17"}]}], "references": [{"url": "https://github.com/redis/redis/security/advisories/GHSA-39h2-x6c4-6w4c", "name": "https://github.com/redis/redis/security/advisories/GHSA-39h2-x6c4-6w4c", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/redis/redis/releases/tag/6.2.17", "name": "https://github.com/redis/redis/releases/tag/6.2.17", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/redis/redis/releases/tag/7.2.7", "name": "https://github.com/redis/redis/releases/tag/7.2.7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/redis/redis/releases/tag/7.4.2", "name": "https://github.com/redis/redis/releases/tag/7.4.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416: Use After Free"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-01-06T21:11:51.687Z"}}}, "cveMetadata": {"cveId": "CVE-2024-46981", "state": "PUBLISHED", "dateUpdated": "2025-03-19T20:14:35.152Z", "dateReserved": "2024-09-16T16:10:09.018Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-01-06T21:11:51.687Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "redis", "vendor": "redis", "versions": [{"status": "affected", "version": ">= 7.4.0, < 7.4.2"}, {"status": "affected", "version": ">= 7.2.0, < 7.2.7"}, {"status": "affected", "version": "< 6.2.17"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*", "matchCriteriaId": "27C4B131-D7C9-4F37-B055-F6228ECB64E3", "versionEndExcluding": "6.2.17", "versionStartIncluding": "6.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*", "matchCriteriaId": "0CF4D1D8-00CB-4FBC-9B53-5A501ABCEC04", "versionEndExcluding": "7.2.7", "versionStartIncluding": "7.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*", "matchCriteriaId": "4C650091-3AC4-4A82-99E8-265600DBD02E", "versionEndExcluding": "7.4.2", "versionStartIncluding": "7.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands."}, {"lang": "es", "value": "Redis es una base de datos en memoria de c\u00f3digo abierto que persiste en el disco. Un usuario autenticado puede usar un script Lua especialmente manipulado para manipular el recolector de elementos no utilizados y potencialmente provocar la ejecuci\u00f3n remota de c\u00f3digo. El problema se solucion\u00f3 en 7.4.2, 7.2.7 y 6.2.17. Un workaround adicional para mitigar el problema sin aplicar un parche al ejecutable redis-server es evitar que los usuarios ejecuten scripts Lua. Esto se puede hacer usando ACL para restringir los comandos EVAL y EVALSHA."}], "id": "CVE-2024-46981", "lastModified": "2026-06-17T07:56:18.577", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-46981", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-01-06T21:41:47.467485Z", "version": "2.0.3"}}]}, "published": "2025-01-06T22:15:09.360", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/redis/redis/releases/tag/6.2.17"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/redis/redis/releases/tag/7.2.7"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/redis/redis/releases/tag/7.4.2"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/redis/redis/security/advisories/GHSA-39h2-x6c4-6w4c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00018.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.vicarius.io/vsociety/posts/cve-2024-46981-detect-redis-vulnerability"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.vicarius.io/vsociety/posts/cve-2024-46981-mitigate-redis-vulnerability"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2025:1249", "cpe": "cpe:/o:redhat:discovery:1.0::el9", "package": "discovery/discovery-server-rhel9:1.12.0-1", "product_name": "Discovery 1 for RHEL 9", "release_date": "2025-02-10T00:00:00Z"}, {"advisory": "RHSA-2025:1249", "cpe": "cpe:/o:redhat:discovery:1.0::el9", "package": "discovery/discovery-ui-rhel9:1.12.0-1", "product_name": "Discovery 1 for RHEL 9", "release_date": "2025-02-10T00:00:00Z"}, {"advisory": "RHSA-2025:0595", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "redis:6-8100020250113083959.489197e6", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2025-01-22T00:00:00Z"}, {"advisory": "RHSA-2025:0685", "cpe": "cpe:/a:redhat:rhel_aus:8.4", "package": "redis:6-8040020250123095605.522a0ee4", "product_name": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "release_date": "2025-01-27T00:00:00Z"}, {"advisory": "RHSA-2025:0685", "cpe": "cpe:/a:redhat:rhel_tus:8.4", "package": "redis:6-8040020250123095605.522a0ee4", "product_name": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", "release_date": "2025-01-27T00:00:00Z"}, {"advisory": "RHSA-2025:0685", "cpe": "cpe:/a:redhat:rhel_e4s:8.4", "package": "redis:6-8040020250123095605.522a0ee4", "product_name": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions", "release_date": "2025-01-27T00:00:00Z"}, {"advisory": "RHSA-2025:0689", "cpe": "cpe:/a:redhat:rhel_aus:8.6", "package": "redis:6-8060020250122114132.ad008a3a", "product_name": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "release_date": "2025-01-27T00:00:00Z"}, {"advisory": "RHSA-2025:0689", "cpe": "cpe:/a:redhat:rhel_tus:8.6", "package": "redis:6-8060020250122114132.ad008a3a", "product_name": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "release_date": "2025-01-27T00:00:00Z"}, {"advisory": "RHSA-2025:0689", "cpe": "cpe:/a:redhat:rhel_e4s:8.6", "package": "redis:6-8060020250122114132.ad008a3a", "product_name": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "release_date": "2025-01-27T00:00:00Z"}, {"advisory": "RHSA-2025:0640", "cpe": "cpe:/a:redhat:rhel_eus:8.8", "package": "redis:6-8080020250120175236.63b34585", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2025-01-23T00:00:00Z"}, {"advisory": "RHSA-2025:0692", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "redis:7-9050020250115104757.9", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-01-27T00:00:00Z"}, {"advisory": "RHSA-2025:0693", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "redis-0:6.2.17-1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-01-27T00:00:00Z"}, {"advisory": "RHSA-2025:0400", "cpe": "cpe:/a:redhat:rhel_e4s:9.0", "package": "redis-0:6.2.6-1.el9_0.1", "product_name": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "release_date": "2025-01-20T00:00:00Z"}, {"advisory": "RHSA-2025:0398", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "redis-0:6.2.7-1.el9_2.1", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2025-01-20T00:00:00Z"}, {"advisory": "RHSA-2025:0399", "cpe": "cpe:/a:redhat:rhel_eus:9.4", "package": "redis-0:6.2.7-1.el9_4.1", "product_name": "Red Hat Enterprise Linux 9.4 Extended Update Support", "release_date": "2025-01-20T00:00:00Z"}, {"advisory": "RHSA-2025:0566", "cpe": "cpe:/a:redhat:rhel_eus:9.4", "package": "redis:7-9040020250120173627.9", "product_name": "Red Hat Enterprise Linux 9.4 Extended Update Support", "release_date": "2025-01-21T00:00:00Z"}], "bugzilla": {"description": "redis: Redis' Lua library commands may lead to remote code execution", "id": "2336004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2336004"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-416", "details": ["Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.", "A flaw was found in the Redis server. This flaw allows an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, potentially leading to remote code execution."], "mitigation": {"lang": "en:us", "value": "A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands."}, "name": "CVE-2024-46981", "package_state": [{"cpe": "cpe:/a:redhat:openshift_lightspeed", "fix_state": "Affected", "package_name": "openshift-lightspeed-tech-preview/lightspeed-service-api-rhel9", "product_name": "OpenShift Lightspeed"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform", "fix_state": "Not affected", "package_name": "ansible-tower", "product_name": "Red Hat Ansible Automation Platform 1.2"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:1", "fix_state": "Will not fix", "package_name": "rhelai1/bootc-amd-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI)"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:1", "fix_state": "Will not fix", "package_name": "rhelai1/bootc-azure-amd-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI)"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:1", "fix_state": "Will not fix", "package_name": "rhelai1/instructlab-amd-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI)"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Not affected", "package_name": "io.hawt-hawtio-integration", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:quay:3", "fix_state": "Affected", "package_name": "quay/quay-rhel8", "product_name": "Red Hat Quay 3"}], "public_date": "2025-01-06T21:11:51Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-46981\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-46981\nhttps://github.com/redis/redis/releases/tag/6.2.17\nhttps://github.com/redis/redis/releases/tag/7.2.7\nhttps://github.com/redis/redis/releases/tag/7.4.2\nhttps://github.com/redis/redis/security/advisories/GHSA-39h2-x6c4-6w4c"], "statement": "The problem exists in all versions of Redis with Lua scripting.\nThis vulnerability in Redis is classified as high severity rather than moderate due to its potential impact and exploitation scope. By manipulating the Lua garbage collector through crafted scripts, an authenticated attacker can achieve remote code execution (RCE), allowing them to execute arbitrary commands on the host system. This compromises not only the integrity and confidentiality of the data stored in Redis but also the underlying server itself. Furthermore, the exploitation does not require direct access to the server binary, making it feasible for attackers to execute through legitimate, albeit malicious, commands.", "threat_severity": "Important"}

{}