<antirez>
2 days ago
- Apple Information Security team discovered vulnerabilities in Redis Lua libraries (cmsgpack and struct).
- Vulnerabilities allow memory corruption and potential remote code execution, especially in cloud multi-tenant environments.
- Normal Redis users are less at risk if they trust their input.
- Redis maintainer coordinated with major cloud providers to patch before public disclosure.
- Five security fixes were released, including four for Lua subsystem and one for redis-cli.
- Future plans include Lua stack protection, fuzz testing, HMAC for untrusted data, improved sandboxing, and possible Lua upgrade.