CVE-2024-51741

Redis es una base de datos en memoria de código abierto que persiste en el disco. Un usuario autenticado con privilegios suficientes puede crear un selector de ACL mal formado que, cuando se accede a él, desencadena un pánico del servidor y la consiguiente denegación de servicio. El problema se solucionó en Redis 7.2.7 y 7.4.2.

A flaw was found in the Redis server. An authenticated attacker with sufficient privileges can create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service.

It was discovered that Redis incorrectly handled certain memory operations during pattern matching. An attacker could possibly use this issue to cause a denial of service. It was discovered that Redis incorrectly handled certain specially crafted Lua scripts. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. It was discovered that Redis incorrectly handled some malformed ACL selectors. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.10 and Ubuntu 24.04 LTS.