CVE-2024-31228

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2024-31228

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-31228.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-31228

Aliases

Related

Published

2024-10-07T20:15:05Z

Modified

2024-12-05T15:38:18.341214Z

Summary

[none]

Details

Redis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as KEYS, SCAN, PSUBSCRIBE, FUNCTION LIST, COMMAND LIST and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crash. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

References

Affected packages

Alpine:v3.17 / redis

Package

Name: redis
Purl: pkg:apk/alpine/redis?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.0.15-r1

Affected versions

2.*

2.4.14-r0

2.4.14-r1

2.4.14-r2

2.4.16-r0

2.6.16-r0

2.6.17-r0

2.8.9-r0

2.8.9-r1

2.8.9-r2

2.8.10-r0

2.8.11-r0

2.8.12-r0

2.8.13-r0

2.8.14-r0

2.8.17-r0

2.8.19-r0

3.*

3.0.0-r0

3.0.0-r1

3.0.1-r0

3.0.2-r0

3.0.3-r0

3.0.4-r0

3.0.5-r0

3.0.5-r1

3.0.6-r0

3.0.7-r0

3.0.7-r1

3.2.0-r0

3.2.1-r0

3.2.3-r0

3.2.4-r0

3.2.5-r0

3.2.7-r0

3.2.8-r0

3.2.9-r0

4.*

4.0.2-r0

4.0.2-r1

4.0.5-r0

4.0.6-r0

4.0.8-r0

4.0.9-r0

4.0.9-r1

4.0.9-r2

4.0.10-r0

4.0.10-r1

4.0.11-r0

4.0.12-r0

4.0.13-r0

5.*

5.0.4-r0

5.0.5-r0

5.0.7-r0

5.0.8-r0

5.0.9-r0

6.*

6.0.1-r0

6.0.4-r0

6.0.5-r0

6.0.9-r0

6.0.10-r0

6.2.0-r0

6.2.1-r0

6.2.2-r0

6.2.3-r0

6.2.4-r0

6.2.5-r0

6.2.6-r0

6.2.7-r0

7.*

7.0.0-r0

7.0.2-r0

7.0.3-r0

7.0.4-r0

7.0.4-r1

7.0.4-r2

7.0.5-r0

7.0.6-r0

7.0.7-r0

7.0.8-r0

7.0.9-r0

7.0.10-r0

7.0.11-r0

7.0.12-r0

7.0.13-r0

7.0.14-r0

7.0.15-r0

Alpine:v3.18 / redis

Package

Name: redis
Purl: pkg:apk/alpine/redis?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.0.15-r1

Affected versions

2.*

2.4.14-r0

2.4.14-r1

2.4.14-r2

2.4.16-r0

2.6.16-r0

2.6.17-r0

2.8.9-r0

2.8.9-r1

2.8.9-r2

2.8.10-r0

2.8.11-r0

2.8.12-r0

2.8.13-r0

2.8.14-r0

2.8.17-r0

2.8.19-r0

3.*

3.0.0-r0

3.0.0-r1

3.0.1-r0

3.0.2-r0

3.0.3-r0

3.0.4-r0

3.0.5-r0

3.0.5-r1

3.0.6-r0

3.0.7-r0

3.0.7-r1

3.2.0-r0

3.2.1-r0

3.2.3-r0

3.2.4-r0

3.2.5-r0

3.2.7-r0

3.2.8-r0

3.2.9-r0

4.*

4.0.2-r0

4.0.2-r1

4.0.5-r0

4.0.6-r0

4.0.8-r0

4.0.9-r0

4.0.9-r1

4.0.9-r2

4.0.10-r0

4.0.10-r1

4.0.11-r0

4.0.12-r0

4.0.13-r0

5.*

5.0.4-r0

5.0.5-r0

5.0.7-r0

5.0.8-r0

5.0.9-r0

6.*

6.0.1-r0

6.0.4-r0

6.0.5-r0

6.0.9-r0

6.0.10-r0

6.2.0-r0

6.2.1-r0

6.2.2-r0

6.2.3-r0

6.2.4-r0

6.2.5-r0

6.2.6-r0

6.2.7-r0

7.*

7.0.0-r0

7.0.2-r0

7.0.3-r0

7.0.4-r0

7.0.4-r1

7.0.4-r2

7.0.5-r0

7.0.6-r0

7.0.7-r0

7.0.8-r0

7.0.9-r0

7.0.10-r0

7.0.10-r1

7.0.11-r0

7.0.12-r0

7.0.13-r0

7.0.14-r0

7.0.15-r0

Alpine:v3.19 / redis

Package

Name: redis
Purl: pkg:apk/alpine/redis?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.2.4-r1

Affected versions

2.*

2.4.14-r0

2.4.14-r1

2.4.14-r2

2.4.16-r0

2.6.16-r0

2.6.17-r0

2.8.9-r0

2.8.9-r1

2.8.9-r2

2.8.10-r0

2.8.11-r0

2.8.12-r0

2.8.13-r0

2.8.14-r0

2.8.17-r0

2.8.19-r0

3.*

3.0.0-r0

3.0.0-r1

3.0.1-r0

3.0.2-r0

3.0.3-r0

3.0.4-r0

3.0.5-r0

3.0.5-r1

3.0.6-r0

3.0.7-r0

3.0.7-r1

3.2.0-r0

3.2.1-r0

3.2.3-r0

3.2.4-r0

3.2.5-r0

3.2.7-r0

3.2.8-r0

3.2.9-r0

4.*

4.0.2-r0

4.0.2-r1

4.0.5-r0

4.0.6-r0

4.0.8-r0

4.0.9-r0

4.0.9-r1

4.0.9-r2

4.0.10-r0

4.0.10-r1

4.0.11-r0

4.0.12-r0

4.0.13-r0

5.*

5.0.4-r0

5.0.5-r0

5.0.7-r0

5.0.8-r0

5.0.9-r0

6.*

6.0.1-r0

6.0.4-r0

6.0.5-r0

6.0.9-r0

6.0.10-r0

6.2.0-r0

6.2.1-r0

6.2.2-r0

6.2.3-r0

6.2.4-r0

6.2.5-r0

6.2.6-r0

6.2.7-r0

7.*

7.0.0-r0

7.0.2-r0

7.0.3-r0

7.0.4-r0

7.0.4-r1

7.0.4-r2

7.0.5-r0

7.0.6-r0

7.0.7-r0

7.0.8-r0

7.0.9-r0

7.0.10-r0

7.0.10-r1

7.0.11-r0

7.0.12-r0

7.2.0-r0

7.2.1-r0

7.2.2-r0

7.2.3-r0

7.2.4-r0

Alpine:v3.20 / valkey

Package

Name: valkey
Purl: pkg:apk/alpine/valkey?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.2.7-r0

Affected versions

7.*

7.2.5-r0

7.2.5-r1

7.2.5-r2

Alpine:v3.21 / valkey

Package

Name: valkey
Purl: pkg:apk/alpine/valkey?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.2.7-r0

Affected versions

7.*

7.2.5-r0

7.2.5-r1

7.2.5-r2

Debian:13 / redict

Package

Name: redict
Purl: pkg:deb/debian/redict?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.3.1+ds-1

Affected versions

7.*

7.3.0+ds-1

7.3.0+ds-2

7.3.0+ds-3~bpo12+1

7.3.0+ds-3

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:11 / redis

Package

Name: redis
Purl: pkg:deb/debian/redis?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5:6.0.16-1+deb11u4

Affected versions

5:6.*

5:6.0.15-1

5:6.0.16-1~bpo10+1

5:6.0.16-1~bpo11+1

5:6.0.16-1

5:6.0.16-1+deb11u1

5:6.0.16-1+deb11u2

5:6.0.16-1+deb11u3

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / redis

Package

Name: redis
Purl: pkg:deb/debian/redis?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

5:7.*

5:7.0.11-1

5:7.0.11-1+deb12u1

5:7.0.12-1

5:7.0.12-2

5:7.0.13-1

5:7.0.13-2

5:7.0.14-1

5:7.0.14-2

5:7.0.15-1~deb12u1

5:7.0.15-1

5:7.0.15-2

5:7.2~rc1-1

5:7.2-rc2-1

5:7.2-rc3-1

5:7.2.0-1

5:7.2.0-2

5:7.2.1-1

5:7.2.1-2

5:7.2.2-1

5:7.2.2-2

5:7.2.3-1

5:7.2.4-1

5:7.2.5-1

5:7.2.5-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / redis

Package

Name: redis
Purl: pkg:deb/debian/redis?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5:7.0.15-2

Affected versions

5:7.*

5:7.0.11-1

5:7.0.12-1

5:7.0.12-2

5:7.0.13-1

5:7.0.13-2

5:7.0.14-1

5:7.0.14-2

5:7.0.15-1~deb12u1

5:7.0.15-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / valkey

Package

Name: valkey
Purl: pkg:deb/debian/valkey?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8.0.1+dfsg1-1

Affected versions

7.*

7.2.5+dfsg1-1

7.2.5+dfsg1-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/redis/redis

Affected ranges

Type: GIT
Repo: https://github.com/redis/redis
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

9317bf64659b33166a943ec03d5d9b954e86afb0

Affected versions

1.*

1.3.6

2.*

2.2-alpha0

2.2-alpha1

2.2-alpha2

2.2-alpha3

2.2-alpha4

2.2-alpha5

2.2-alpha6

2.2.0-rc1

2.3-alpha0

3.*

3.0-alpha0

6.*

6.2-rc1

6.2-rc2

6.2-rc3

6.2.0

6.2.1

6.2.10

6.2.11

6.2.12

6.2.13

6.2.14

6.2.15

6.2.2

6.2.3

6.2.4

6.2.5

6.2.6

6.2.7

6.2.8

6.2.9

v1.*

v1.3.10

v1.3.11

v1.3.12

v1.3.7

v1.3.8

v1.3.9

v2.*

v2.0.0-rc1

v2.1.1-watch

Other

vm-playpen

with-deprecated-diskstore