megachangelog
Security7.4.11

Redis 7.4.11 Security Update

This release includes multiple critical security fixes addressing use-after-free vulnerabilities in TLS and blocked-client handling, ACL key permission bypass issues in several commands, out-of-bounds memory access during ACL permission checks, and RDB loading vulnerabilities that could lead to remote code execution.

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

  • Use-after-free in the TLS pending-data list when a command closes another pending connection
  • #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
  • #14847 Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity
  • A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
  • #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key
securityacltlsrdbmemory-safety

Source: original entry ↗