CVE-2024-31227

Description

Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem exists in Redis 7 prior to versions 7.2.6 and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

How to fix CVE-2024-31227

To remediate CVE-2024-31227, upgrade the affected package to a fixed version below.

—upgrade to 7.0.15-r1 or later
—upgrade to 7.2.7-r0 or later
—no fix listed
—upgrade to 7.2.8 or later
—upgrade to 7.2.7 or later
—upgrade to 7.3.1+ds-1 or later
—upgrade to 5:7.0.15-1~deb12u2 or later
—upgrade to 8.0.1+dfsg1-1 or later

Is CVE-2024-31227 being exploited?

Low — EPSS is 0.4%, meaning exploitation activity has not been observed at scale.

Affected packages (8)

from 0, < 7.0.15-r1
from 0, < 7.2.7-r0
>= 7.0.0
>= 7.0.0, < 7.2.8, >= 7.3.0, < 7.4.1
from 0, < 7.2.7, >= 8.0.0, < 8.0.1
from 0, < 7.3.1+ds-1
from 0, < 5:7.0.15-1~deb12u2
from 0, < 8.0.1+dfsg1-1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM4.4	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H