CVE-2024-31228

CVSS V2 None CVSS V3 None

Description

Redis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST` and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crash. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Overview

CVE ID
CVE-2024-31228

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2024-10-07T19:51:06.784Z

Last Modified Date
2024-10-07T20:20:24.001Z

Weakness Enumerations

CWE	URL
CWE-674	http://cwe.mitre.org/data/definitions/674.html

References

Reference URL	Reference Tags
https://github.com/redis/redis/security/advisories/GHSA-66gq-c942-6976	x_refsource_CONFIRM
https://github.com/redis/redis/commit/9317bf64659b33166a943ec03d5d9b954e86afb0	x_refsource_MISC

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-31228
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-31228

History

Created	Old Value	New Value	Data Type	Notes
2024-10-08 13:08:01				Added to TrackCVE