Detections
Analytics
Alpine: multiple redis packages: security update to 7.0.15-r1
high Tenable Cloud Security Plugin ID 408527
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient
privileges may create a malformed ACL selector which, when accessed, triggers a server panic and
subsequent denial of service. The problem exists in Redis 7 prior to versions 7.2.6 and 7.4.1. Users are
advised to upgrade. There are no known workarounds for this vulnerability. (CVE-2024-31227)
- Redis is an open source, in-memory database that persists on disk. Authenticated users can trigger a
denial-of-service by using specially crafted, long string match patterns on supported commands such as
`KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST` and ACL definitions. Matching of extremely
long patterns may result in unbounded recursion, leading to stack overflow and process crash. This problem
has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no
known workarounds for this vulnerability. (CVE-2024-31228)
- Redis is an open source, in-memory database that persists on disk. An authenticated user may use a
specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially
lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This
problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are
no known workarounds for this vulnerability. (CVE-2024-31449)
See Also
https://security.alpinelinux.org/vuln/CVE-2024-31227
Plugin Details
Severity: High
ID: 408527
Version: Revision 1.17
Type: Local
Published: 10/2/2024
Updated: 9/5/2025
Supported Sensors: Agentless Assessment
Risk Information
VPR
Risk Factor: Medium
Score: 6.9
Percentile: 96.92
CVSS v2
Risk Factor: High
Base Score: 9
Temporal Score: 7
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2024-31449
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.9
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 9/26/2024