CVE-2022-24834

A heap-based buffer overflow flaw was found in Redis. This flaw allows a local authenticated attacker user or attacker to execute a specially crafted Lua script in Redis. This attack triggers a heap overflow in the cjson and cmsgpack libraries, resulting in heap corruption and potential remote code execution.

Mitigation

Prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.