p PatchFirst

CVE-2022-24834

CVE-2022-24834 · Heap overflow issue with the Lua cjson library used by Redis

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. The problem is fixed in versions 7.0.12, 6.2.13, and 6.0.20.

CVSS 7.0 · High · EPSS 41.1% · Fix available

Published
Updated

Stack: system · database

Affected products and versions

  • redis

    Versions
    • >= 7.0.0, < 7.0.12: Affected
    • >= 6.2.0, < 6.2.13: Affected
    • >= 6.0.0, < 6.0.20: Affected

    No fix published

  • redis Debian:12

    Versions
    • 5:7.0.11-1
    • 5:7.0.11-1+deb12u1
    • 5:7.0.12-1
    • 5:7.0.12-2
    • 5:7.0.13-1
    • 5:7.0.13-2
    • 5:7.0.14-1
    • 5:7.0.14-2
    Affected ranges
    • ECOSYSTEM: < 5:7.0.15-1~deb12u1

    Update to 5:7.0.15-1~deb12u1

  • redis Debian:13

    Affected ranges
    • ECOSYSTEM: < 5:7.0.12-1

    Update to 5:7.0.12-1

  • redis Debian:14

    Affected ranges
    • ECOSYSTEM: < 5:7.0.12-1

    Update to 5:7.0.12-1

  • redis Ubuntu:Pro:14.04:LTS

    Versions
    • 2:2.6.13-1
    • 2:2.6.16-3
    • 2:2.8.0-1
    • 2:2.8.2-1
    • 2:2.8.4-2
    • 2:2.8.4-2ubuntu0.2
    • 2:2.8.4-2ubuntu0.2+esm1
    • 2:2.8.4-2ubuntu0.2+esm2
    Affected ranges
    • ECOSYSTEM: < 2:2.8.4-2ubuntu0.2+esm3

    Update to 2:2.8.4-2ubuntu0.2+esm3

  • redis Ubuntu:Pro:16.04:LTS

    Versions
    • 2:3.0.3-3
    • 2:3.0.5-1
    • 2:3.0.5-2
    • 2:3.0.5-3
    • 2:3.0.5-4
    • 2:3.0.6-1
    • 2:3.0.6-1ubuntu0.2
    • 2:3.0.6-1ubuntu0.3
    • 2:3.0.6-1ubuntu0.4
    • 2:3.0.6-1ubuntu0.4+esm1
    Affected ranges
    • ECOSYSTEM: < 2:3.0.6-1ubuntu0.4+esm2

    Update to 2:3.0.6-1ubuntu0.4+esm2

  • lua-cjson Ubuntu:16.04:LTS

    Versions
    • 2.1.0+dfsg-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • lua-cjson Ubuntu:18.04:LTS

    Versions
    • 2.1.0+dfsg-2
    • 2.1.0+dfsg-2.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • redis Ubuntu:Pro:18.04:LTS

    Versions
    • 4:4.0.1-7
    • 4:4.0.2-6
    • 4:4.0.2-9
    • 5:4.0.5-1
    • 5:4.0.6-1
    • 5:4.0.6-2
    • 5:4.0.7-1
    • 5:4.0.8-1
    • 5:4.0.8-2
    • 5:4.0.9-1
    • 5:4.0.9-1ubuntu0.1
    • 5:4.0.9-1ubuntu0.2
    • 5:4.0.9-1ubuntu0.2+esm2
    • 5:4.0.9-1ubuntu0.2+esm3
    Affected ranges
    • ECOSYSTEM: < 5:4.0.9-1ubuntu0.2+esm4

    Update to 5:4.0.9-1ubuntu0.2+esm4

  • lua-cjson Ubuntu:Pro:20.04:LTS

    Versions
    • 2.1.0+dfsg-2.1
    Affected ranges
    • ECOSYSTEM: < 2.1.0+dfsg-2.1ubuntu0.20.04.1~esm2

    Update to 2.1.0+dfsg-2.1ubuntu0.20.04.1~esm2

  • redis Ubuntu:Pro:20.04:LTS

    Versions
    • 5:5.0.5-2build1
    • 5:5.0.6-1
    • 5:5.0.7-1
    • 5:5.0.7-2
    • 5:5.0.7-2ubuntu0.1~esm1
    • 5:5.0.7-2ubuntu0.1
    • 5:5.0.7-2ubuntu0.1+esm1
    Affected ranges
    • ECOSYSTEM: < 5:5.0.7-2ubuntu0.1+esm2

    Update to 5:5.0.7-2ubuntu0.1+esm2

  • lua-cjson Ubuntu:Pro:22.04:LTS

    Versions
    • 2.1.0+dfsg-2.1
    Affected ranges
    • ECOSYSTEM: < 2.1.0+dfsg-2.1ubuntu0.22.04.1~esm2

    Update to 2.1.0+dfsg-2.1ubuntu0.22.04.1~esm2

  • redis Ubuntu:Pro:22.04:LTS

    Versions
    • 5:6.0.15-1
    • 5:6.0.16-1
    • 5:6.0.16-1build1
    • 5:6.0.16-1ubuntu1
    Affected ranges
    • ECOSYSTEM: < 5:6.0.16-1ubuntu1+esm1

    Update to 5:6.0.16-1ubuntu1+esm1

  • lua-cjson Ubuntu:24.04:LTS

    Versions
    • 2.1.0+dfsg-2.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • lua-cjson Ubuntu:25.10

    Versions
    • 2.1.0+dfsg-2.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • lua-cmsgpack Ubuntu:25.10

    Versions
    • 0.4.0~git20230328.57b1f90-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • lua-cjson Ubuntu:26.10

    Versions
    • 2.1.0+dfsg-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • lua-cmsgpack Ubuntu:26.10

    Versions
    • 0.4.0~git20230328.57b1f90-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • lua-cjson Ubuntu:26.04:LTS

    Versions
    • 2.1.0+dfsg-2.2
    • 2.1.0+dfsg-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • lua-cmsgpack Ubuntu:26.04:LTS

    Versions
    • 0.4.0~git20230328.57b1f90-2
    • 0.4.0~git20230328.57b1f90-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →