Technology newsroom
Redis releases emergency patch! 🚨 Fixes critical zero-day vulnerability, risk of RCE. Admins should update immediately.
Redis released an emergency security patch to fix multiple Zero-Day vulnerabilities that could lead to remote code execution (RCE). Administrators using vulnerable versions 6.x, 7.x, and 8.x should update immediately.
📌 Summary of important points:
- Researchers have discovered a serious vulnerability in Redis that could lead to remote code execution (RCE)
- The versions directly affected are Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0
- Redis has released updates to fix the issue in versions 6.2.23, 7.2.15, 7.4.10, and newer versions. Administrators should update immediately.
Big news for administrators and developers using Redis as multiple Zero-Day vulnerabilities were simultaneously disclosed, affecting several versions of Redis. These vulnerabilities are severe enough that a malicious actor could potentially execute remote code (RCE) on the server. After researchers released proof-of-concept attack code, Redis immediately issued 7 security updates on July 23.
⚙️ In-depth look at vulnerabilities
Attacks exploiting these vulnerabilities require authentication (Authenticated) first, but they are still considered highly dangerous in environments where access is not tightly restricted. The main vulnerabilities stem from memory flaws, where the attack primarily uses the RESTORE command, along with other commands such as EVAL and XGROUP in some cases, or requires the RedisBloom module that comes with version 8.8.0 to succeed.
📢 Urgent advice for administrators
Redis has confirmed that these memory-related vulnerabilities can indeed lead to Remote Code Execution. Therefore, it is recommended that administrators using vulnerable versions of Redis, including 6.2.22, 7.4.9, 8.6.4, and 8.8.0, update to the secure versions as soon as possible, which are 6.2.23, 7.2.15, 7.4.10, and the latest version in the 8.x series, to mitigate the risk of being attacked.
💬 Which version of Redis is your system using? Have you checked and updated it yet?