Detections
Analytics

Alpine: multiple valkey packages: security update to 7.2.8-r0

critical Tenable Self-Hosted Container Security Plugin ID 424583

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - Redis is an open source, in-memory database that persists on disk. An authenticated user may use a
 specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code
 execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional workaround to mitigate the
 problem without patching the redis-server executable is to prevent users from executing Lua scripts. This
 can be done using ACL to restrict EVAL and EVALSHA commands. (CVE-2024-46981)

 - Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient
 privileges may create a malformed ACL selector which, when accessed, triggers a server panic and
 subsequent denial of service. The problem is fixed in Redis 7.2.7 and 7.4.2. (CVE-2024-51741)

See Also

https://security.alpinelinux.org/vuln/CVE-2024-46981

https://security.alpinelinux.org/vuln/CVE-2024-51741

Plugin Details

Severity: Critical

ID: 424583

Version: Revision 1.8

Type: Local

Published: 4/4/2025

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.96

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2024-46981

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 1/6/2025

Reference Information

CVE: CVE-2024-46981, CVE-2024-51741