Company
Date Published
Author
Quincy Castro
Word count
644
Language
English
Hacker News points
None

Summary

The latest version of Redis has identified four security vulnerabilities that have been remediated in the versions indicated below. The vulnerabilities include a Lua Use-After-Free Remote Code Execution Vulnerability with a CVSS Score of 7.0 (High), an Integer Overflow with LIMIT or KNN Arguments Can Lead to RCE vulnerability in RediSearch with a CVSS Score of 7.0 (High), an Integer Overflow Remote Code Execution Vulnerability in RedisTimeSeries with a CVSS Score of 7.0 (High), and an Integer Overflow Remote Code Execution Vulnerability in RedisBloom with a CVSS Score of 8.8 (High). These vulnerabilities can only be exploited by authenticated users with permission to run Lua scripts, FT.SEARCH or FT.AGGREGATE commands, TS.QUERYINDEX, TS.MGET, TS.MRAGE, TS.MREVRANGE commands, and CMS.INITBYDIM command respectively. To protect against these vulnerabilities, it is recommended to follow best practices such as securely configuring, deploying, and using Redis, upgrading to the latest release, and monitoring for potential exploitation indicators.