{"id":9000,"date":"2019-07-19T03:03:54","date_gmt":"2019-07-19T03:03:54","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=9000"},"modified":"2026-04-17T18:07:52","modified_gmt":"2026-04-17T18:07:52","slug":"redis-activestandby-synchronization-code-execution-vulnerability-threat-alert","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/redis-activestandby-synchronization-code-execution-vulnerability-threat-alert\/","title":{"rendered":"Redis Active\/Standby Synchronization Code Execution Vulnerability Threat Alert"},"content":{"rendered":"


\n<\/p>\n

<\/a><\/a>1 Vulnerability Description<\/strong><\/h2>\n

Written in ANSIC, Redis is an open-source, memory- or network-bound key-value database which can store logs in a persistent manner. It provides multilingual APIs.<\/p>\n

Since Redis 4.0, the modules system has been added to allow users to write code to extend the existing functions and implement new functions. An attacker with access to Redis could exploit the modules system to introduce a malicious module to the active host instance which will later synchronize the malicious module to the standby host through fullresync before a malicious .so file is loaded on the standby host for malicious code execution. The exploit of this vulnerability has been made public, and therefore users should take temporary protection measures as soon as possible to protect against this vulnerability.<\/p>\n

<\/a>2 Scope of Impact<\/strong><\/h2>\n

Affected Versions<\/p>\n