Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis prior to version 7.0.0 or 6.2.7 can inject Lua code that will execute with the (potentially higher) privileges of another Redis user. The Lua script execution environment in Redis provides some measures that prevent a script from creating side effects that persist and can affect the execution of the same, or different script, at a later time. Several weaknesses of these measures have been publicly known for a long time, but they had no security impact as the Redis security model did not endorse the concept of users or privileges. With the introduction of ACLs in Redis 6.0, these weaknesses can be exploited by a less privileged users to inject Lua code that will execute at a later time, when a privileged user executes a Lua script. The problem is fixed in Redis versions 7.0.0 and 6.2.7. An additional workaround to mitigate this problem without patching the redis-server executable, if Lua scripting is not being used, is to block access to `SCRIPT LOAD` and `EVAL` commands using ACL rules.

• https://github.com/redis/redis/pull/10651
• https://github.com/redis/redis/releases/tag/6.2.7
• https://github.com/redis/redis/releases/tag/7.0.0
• https://github.com/redis/redis/security/advisories/GHSA-647m-2wmq-qmvq
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J4ZK3675DGHVVDOFLJN7WX6YYH27GPMK/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VPYKSG7LKUJGVM2P72EHXKVRVRWHLORX/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WSTPUCAPBRHIFPSCOURR4OYX4E2OISAF/
• https://security.gentoo.org/glsa/202209-17
• https://security.netapp.com/advisory/ntap-20220715-0003/
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://github.com/redis/redis/pull/10651
• https://github.com/redis/redis/releases/tag/6.2.7
• https://github.com/redis/redis/releases/tag/7.0.0
• https://github.com/redis/redis/security/advisories/GHSA-647m-2wmq-qmvq
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J4ZK3675DGHVVDOFLJN7WX6YYH27GPMK/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VPYKSG7LKUJGVM2P72EHXKVRVRWHLORX/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WSTPUCAPBRHIFPSCOURR4OYX4E2OISAF/
• https://security.gentoo.org/glsa/202209-17
• https://security.netapp.com/advisory/ntap-20220715-0003/
• https://www.oracle.com/security-alerts/cpujul2022.html

• Netapp » Management Services For Element Software » Version: N/A
  cpe:2.3:a:netapp:management_services_for_element_software:-
• Netapp » Management Services For Netapp Hci » Version: N/A
  cpe:2.3:a:netapp:management_services_for_netapp_hci:-
• Oracle » Communications Operations Monitor » Version: 4.3
  cpe:2.3:a:oracle:communications_operations_monitor:4.3
• Oracle » Communications Operations Monitor » Version: 4.4
  cpe:2.3:a:oracle:communications_operations_monitor:4.4
• Oracle » Communications Operations Monitor » Version: 5.0
  cpe:2.3:a:oracle:communications_operations_monitor:5.0
• Redis » Redis » Version: N/A
  cpe:2.3:a:redis:redis:-
• Redis » Redis » Version: 1.3.6
  cpe:2.3:a:redis:redis:1.3.6
• Redis » Redis » Version: 2.0.0
  cpe:2.3:a:redis:redis:2.0.0
• Redis » Redis » Version: 2.0.1
  cpe:2.3:a:redis:redis:2.0.1
• Redis » Redis » Version: 2.0.2
  cpe:2.3:a:redis:redis:2.0.2
• Redis » Redis » Version: 2.0.3
  cpe:2.3:a:redis:redis:2.0.3
• Redis » Redis » Version: 2.0.4
  cpe:2.3:a:redis:redis:2.0.4
• Redis » Redis » Version: 2.0.5
  cpe:2.3:a:redis:redis:2.0.5
• Redis » Redis » Version: 2.2.0
  cpe:2.3:a:redis:redis:2.2.0
• Redis » Redis » Version: 2.2.1
  cpe:2.3:a:redis:redis:2.2.1
• Redis » Redis » Version: 2.2.10
  cpe:2.3:a:redis:redis:2.2.10
• Redis » Redis » Version: 2.2.11
  cpe:2.3:a:redis:redis:2.2.11
• Redis » Redis » Version: 2.2.12
  cpe:2.3:a:redis:redis:2.2.12
• Redis » Redis » Version: 2.2.13
  cpe:2.3:a:redis:redis:2.2.13
• Redis » Redis » Version: 2.2.14
  cpe:2.3:a:redis:redis:2.2.14
• Redis » Redis » Version: 2.2.15
  cpe:2.3:a:redis:redis:2.2.15
• Redis » Redis » Version: 2.2.2
  cpe:2.3:a:redis:redis:2.2.2
• Redis » Redis » Version: 2.2.3
  cpe:2.3:a:redis:redis:2.2.3
• Redis » Redis » Version: 2.2.4
  cpe:2.3:a:redis:redis:2.2.4
• Redis » Redis » Version: 2.2.5
  cpe:2.3:a:redis:redis:2.2.5
• Redis » Redis » Version: 2.2.6
  cpe:2.3:a:redis:redis:2.2.6
• Redis » Redis » Version: 2.2.7
  cpe:2.3:a:redis:redis:2.2.7
• Redis » Redis » Version: 2.2.8
  cpe:2.3:a:redis:redis:2.2.8
• Redis » Redis » Version: 2.2.9
  cpe:2.3:a:redis:redis:2.2.9
• Redis » Redis » Version: 2.4.0
  cpe:2.3:a:redis:redis:2.4.0
• Redis » Redis » Version: 2.4.1
  cpe:2.3:a:redis:redis:2.4.1
• Redis » Redis » Version: 2.4.10
  cpe:2.3:a:redis:redis:2.4.10
• Redis » Redis » Version: 2.4.11
  cpe:2.3:a:redis:redis:2.4.11
• Redis » Redis » Version: 2.4.12
  cpe:2.3:a:redis:redis:2.4.12
• Redis » Redis » Version: 2.4.13
  cpe:2.3:a:redis:redis:2.4.13
• Redis » Redis » Version: 2.4.14
  cpe:2.3:a:redis:redis:2.4.14
• Redis » Redis » Version: 2.4.15
  cpe:2.3:a:redis:redis:2.4.15
• Redis » Redis » Version: 2.4.16
  cpe:2.3:a:redis:redis:2.4.16
• Redis » Redis » Version: 2.4.17
  cpe:2.3:a:redis:redis:2.4.17
• Redis » Redis » Version: 2.4.18
  cpe:2.3:a:redis:redis:2.4.18
• Redis » Redis » Version: 2.4.2
  cpe:2.3:a:redis:redis:2.4.2
• Redis » Redis » Version: 2.4.3
  cpe:2.3:a:redis:redis:2.4.3
• Redis » Redis » Version: 2.4.4
  cpe:2.3:a:redis:redis:2.4.4
• Redis » Redis » Version: 2.4.5
  cpe:2.3:a:redis:redis:2.4.5
• Redis » Redis » Version: 2.4.6
  cpe:2.3:a:redis:redis:2.4.6
• Redis » Redis » Version: 2.4.7
  cpe:2.3:a:redis:redis:2.4.7
• Redis » Redis » Version: 2.4.8
  cpe:2.3:a:redis:redis:2.4.8
• Redis » Redis » Version: 2.4.9
  cpe:2.3:a:redis:redis:2.4.9
• Redis » Redis » Version: 2.6.0
  cpe:2.3:a:redis:redis:2.6.0
• Redis » Redis » Version: 2.6.1
  cpe:2.3:a:redis:redis:2.6.1
• Redis » Redis » Version: 2.6.10
  cpe:2.3:a:redis:redis:2.6.10
• Redis » Redis » Version: 2.6.11
  cpe:2.3:a:redis:redis:2.6.11
• Redis » Redis » Version: 2.6.12
  cpe:2.3:a:redis:redis:2.6.12
• Redis » Redis » Version: 2.6.13
  cpe:2.3:a:redis:redis:2.6.13
• Redis » Redis » Version: 2.6.14
  cpe:2.3:a:redis:redis:2.6.14
• Redis » Redis » Version: 2.6.15
  cpe:2.3:a:redis:redis:2.6.15
• Redis » Redis » Version: 2.6.16
  cpe:2.3:a:redis:redis:2.6.16
• Redis » Redis » Version: 2.6.17
  cpe:2.3:a:redis:redis:2.6.17
• Redis » Redis » Version: 2.6.2
  cpe:2.3:a:redis:redis:2.6.2
• Redis » Redis » Version: 2.6.3
  cpe:2.3:a:redis:redis:2.6.3
• Redis » Redis » Version: 2.6.4
  cpe:2.3:a:redis:redis:2.6.4
• Redis » Redis » Version: 2.6.5
  cpe:2.3:a:redis:redis:2.6.5
• Redis » Redis » Version: 2.6.6
  cpe:2.3:a:redis:redis:2.6.6
• Redis » Redis » Version: 2.6.7
  cpe:2.3:a:redis:redis:2.6.7
• Redis » Redis » Version: 2.6.8
  cpe:2.3:a:redis:redis:2.6.8
• Redis » Redis » Version: 2.6.9
  cpe:2.3:a:redis:redis:2.6.9
• Redis » Redis » Version: 2.8.0
  cpe:2.3:a:redis:redis:2.8.0
• Redis » Redis » Version: 2.8.1
  cpe:2.3:a:redis:redis:2.8.1
• Redis » Redis » Version: 2.8.10
  cpe:2.3:a:redis:redis:2.8.10
• Redis » Redis » Version: 2.8.11
  cpe:2.3:a:redis:redis:2.8.11
• Redis » Redis » Version: 2.8.12
  cpe:2.3:a:redis:redis:2.8.12
• Redis » Redis » Version: 2.8.13
  cpe:2.3:a:redis:redis:2.8.13
• Redis » Redis » Version: 2.8.14
  cpe:2.3:a:redis:redis:2.8.14
• Redis » Redis » Version: 2.8.15
  cpe:2.3:a:redis:redis:2.8.15
• Redis » Redis » Version: 2.8.16
  cpe:2.3:a:redis:redis:2.8.16
• Redis » Redis » Version: 2.8.17
  cpe:2.3:a:redis:redis:2.8.17
• Redis » Redis » Version: 2.8.18
  cpe:2.3:a:redis:redis:2.8.18
• Redis » Redis » Version: 2.8.19
  cpe:2.3:a:redis:redis:2.8.19
• Redis » Redis » Version: 2.8.2
  cpe:2.3:a:redis:redis:2.8.2
• Redis » Redis » Version: 2.8.20
  cpe:2.3:a:redis:redis:2.8.20
• Redis » Redis » Version: 2.8.21
  cpe:2.3:a:redis:redis:2.8.21
• Redis » Redis » Version: 2.8.22
  cpe:2.3:a:redis:redis:2.8.22
• Redis » Redis » Version: 2.8.23
  cpe:2.3:a:redis:redis:2.8.23
• Redis » Redis » Version: 2.8.24
  cpe:2.3:a:redis:redis:2.8.24
• Redis » Redis » Version: 2.8.3
  cpe:2.3:a:redis:redis:2.8.3
• Redis » Redis » Version: 2.8.4
  cpe:2.3:a:redis:redis:2.8.4
• Redis » Redis » Version: 2.8.5
  cpe:2.3:a:redis:redis:2.8.5
• Redis » Redis » Version: 2.8.6
  cpe:2.3:a:redis:redis:2.8.6
• Redis » Redis » Version: 2.8.7
  cpe:2.3:a:redis:redis:2.8.7
• Redis » Redis » Version: 2.8.8
  cpe:2.3:a:redis:redis:2.8.8
• Redis » Redis » Version: 2.8.9
  cpe:2.3:a:redis:redis:2.8.9
• Redis » Redis » Version: 3.0.0
  cpe:2.3:a:redis:redis:3.0.0
• Redis » Redis » Version: 3.0.1
  cpe:2.3:a:redis:redis:3.0.1
• Redis » Redis » Version: 3.0.2
  cpe:2.3:a:redis:redis:3.0.2
• Redis » Redis » Version: 3.0.3
  cpe:2.3:a:redis:redis:3.0.3
• Redis » Redis » Version: 3.0.4
  cpe:2.3:a:redis:redis:3.0.4
• Redis » Redis » Version: 3.0.5
  cpe:2.3:a:redis:redis:3.0.5
• Redis » Redis » Version: 3.0.6
  cpe:2.3:a:redis:redis:3.0.6
• Redis » Redis » Version: 3.0.7
  cpe:2.3:a:redis:redis:3.0.7
• Redis » Redis » Version: 3.2.0
  cpe:2.3:a:redis:redis:3.2.0
• Redis » Redis » Version: 3.2.1
  cpe:2.3:a:redis:redis:3.2.1
• Redis » Redis » Version: 3.2.10
  cpe:2.3:a:redis:redis:3.2.10
• Redis » Redis » Version: 3.2.11
  cpe:2.3:a:redis:redis:3.2.11
• Redis » Redis » Version: 3.2.12
  cpe:2.3:a:redis:redis:3.2.12
• Redis » Redis » Version: 3.2.13
  cpe:2.3:a:redis:redis:3.2.13
• Redis » Redis » Version: 3.2.2
  cpe:2.3:a:redis:redis:3.2.2
• Redis » Redis » Version: 3.2.3
  cpe:2.3:a:redis:redis:3.2.3
• Redis » Redis » Version: 3.2.4
  cpe:2.3:a:redis:redis:3.2.4
• Redis » Redis » Version: 3.2.5
  cpe:2.3:a:redis:redis:3.2.5
• Redis » Redis » Version: 3.2.6
  cpe:2.3:a:redis:redis:3.2.6
• Redis » Redis » Version: 3.2.7
  cpe:2.3:a:redis:redis:3.2.7
• Redis » Redis » Version: 3.2.8
  cpe:2.3:a:redis:redis:3.2.8
• Redis » Redis » Version: 3.2.9
  cpe:2.3:a:redis:redis:3.2.9
• Redis » Redis » Version: 4.0.0
  cpe:2.3:a:redis:redis:4.0.0
• Redis » Redis » Version: 4.0.1
  cpe:2.3:a:redis:redis:4.0.1
• Redis » Redis » Version: 4.0.10
  cpe:2.3:a:redis:redis:4.0.10
• Redis » Redis » Version: 4.0.11
  cpe:2.3:a:redis:redis:4.0.11
• Redis » Redis » Version: 4.0.12
  cpe:2.3:a:redis:redis:4.0.12
• Redis » Redis » Version: 4.0.13
  cpe:2.3:a:redis:redis:4.0.13
• Redis » Redis » Version: 4.0.14
  cpe:2.3:a:redis:redis:4.0.14
• Redis » Redis » Version: 4.0.2
  cpe:2.3:a:redis:redis:4.0.2
• Redis » Redis » Version: 4.0.3
  cpe:2.3:a:redis:redis:4.0.3
• Redis » Redis » Version: 4.0.4
  cpe:2.3:a:redis:redis:4.0.4
• Redis » Redis » Version: 4.0.5
  cpe:2.3:a:redis:redis:4.0.5
• Redis » Redis » Version: 4.0.6
  cpe:2.3:a:redis:redis:4.0.6
• Redis » Redis » Version: 4.0.7
  cpe:2.3:a:redis:redis:4.0.7
• Redis » Redis » Version: 4.0.8
  cpe:2.3:a:redis:redis:4.0.8
• Redis » Redis » Version: 4.0.9
  cpe:2.3:a:redis:redis:4.0.9
• Redis » Redis » Version: 5.0.0
  cpe:2.3:a:redis:redis:5.0.0
• Redis » Redis » Version: 5.0.1
  cpe:2.3:a:redis:redis:5.0.1
• Redis » Redis » Version: 5.0.10
  cpe:2.3:a:redis:redis:5.0.10
• Redis » Redis » Version: 5.0.11
  cpe:2.3:a:redis:redis:5.0.11
• Redis » Redis » Version: 5.0.12
  cpe:2.3:a:redis:redis:5.0.12
• Redis » Redis » Version: 5.0.13
  cpe:2.3:a:redis:redis:5.0.13
• Redis » Redis » Version: 5.0.14
  cpe:2.3:a:redis:redis:5.0.14
• Redis » Redis » Version: 5.0.2
  cpe:2.3:a:redis:redis:5.0.2
• Redis » Redis » Version: 5.0.3
  cpe:2.3:a:redis:redis:5.0.3
• Redis » Redis » Version: 5.0.4
  cpe:2.3:a:redis:redis:5.0.4
• Redis » Redis » Version: 5.0.5
  cpe:2.3:a:redis:redis:5.0.5
• Redis » Redis » Version: 5.0.6
  cpe:2.3:a:redis:redis:5.0.6
• Redis » Redis » Version: 5.0.7
  cpe:2.3:a:redis:redis:5.0.7
• Redis » Redis » Version: 5.0.8
  cpe:2.3:a:redis:redis:5.0.8
• Redis » Redis » Version: 5.0.9
  cpe:2.3:a:redis:redis:5.0.9
• Redis » Redis » Version: 6.0.0
  cpe:2.3:a:redis:redis:6.0.0
• Redis » Redis » Version: 6.0.1
  cpe:2.3:a:redis:redis:6.0.1
• Redis » Redis » Version: 6.0.10
  cpe:2.3:a:redis:redis:6.0.10
• Redis » Redis » Version: 6.0.11
  cpe:2.3:a:redis:redis:6.0.11
• Redis » Redis » Version: 6.0.12
  cpe:2.3:a:redis:redis:6.0.12
• Redis » Redis » Version: 6.0.13
  cpe:2.3:a:redis:redis:6.0.13
• Redis » Redis » Version: 6.0.14
  cpe:2.3:a:redis:redis:6.0.14
• Redis » Redis » Version: 6.0.15
  cpe:2.3:a:redis:redis:6.0.15
• Redis » Redis » Version: 6.0.16
  cpe:2.3:a:redis:redis:6.0.16
• Redis » Redis » Version: 6.0.17
  cpe:2.3:a:redis:redis:6.0.17
• Redis » Redis » Version: 6.0.19
  cpe:2.3:a:redis:redis:6.0.19
• Redis » Redis » Version: 6.0.2
  cpe:2.3:a:redis:redis:6.0.2
• Redis » Redis » Version: 6.0.3
  cpe:2.3:a:redis:redis:6.0.3
• Redis » Redis » Version: 6.0.4
  cpe:2.3:a:redis:redis:6.0.4
• Redis » Redis » Version: 6.0.5
  cpe:2.3:a:redis:redis:6.0.5
• Redis » Redis » Version: 6.0.6
  cpe:2.3:a:redis:redis:6.0.6
• Redis » Redis » Version: 6.0.7
  cpe:2.3:a:redis:redis:6.0.7
• Redis » Redis » Version: 6.0.8
  cpe:2.3:a:redis:redis:6.0.8
• Redis » Redis » Version: 6.0.9
  cpe:2.3:a:redis:redis:6.0.9
• Redis » Redis » Version: 6.2.0
  cpe:2.3:a:redis:redis:6.2.0
• Redis » Redis » Version: 6.2.1
  cpe:2.3:a:redis:redis:6.2.1
• Redis » Redis » Version: 6.2.2
  cpe:2.3:a:redis:redis:6.2.2
• Redis » Redis » Version: 6.2.3
  cpe:2.3:a:redis:redis:6.2.3
• Redis » Redis » Version: 6.2.4
  cpe:2.3:a:redis:redis:6.2.4
• Redis » Redis » Version: 6.2.5
  cpe:2.3:a:redis:redis:6.2.5
• Redis » Redis » Version: 6.2.6
  cpe:2.3:a:redis:redis:6.2.6
• Redis » Redis » Version: 7.0
  cpe:2.3:a:redis:redis:7.0
• Fedoraproject » Fedora » Version: 34
  cpe:2.3:o:fedoraproject:fedora:34
• Fedoraproject » Fedora » Version: 35
  cpe:2.3:o:fedoraproject:fedora:35
• Fedoraproject » Fedora » Version: 36
  cpe:2.3:o:fedoraproject:fedora:36