# Redis Lua scripting: several security vulnerabilities fixed

DevFeed: [Redis Lua scripting: several security vulnerabilities fixed](<https://devfeed.tech/articles/redis-lua-scripting-several-security-vulnerabilities-fixed-20610.md>)

Original publisher: [Read original article](<http://antirez.com/news/119>)

Published: 2018-06-13T17:15:05Z

Content type: opinion

Language: en

Sources: [Antirez](<https://devfeed.tech/sources/antirez.md>)

Topics: [Redis](<https://devfeed.tech/topics/redis.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Lua](<https://devfeed.tech/topics/lua.md>), [Security](<https://devfeed.tech/topics/security.md>), [Multi-tenancy](<https://devfeed.tech/topics/multi-tenancy.md>), [Cloud](<https://devfeed.tech/topics/cloud.md>), [Python](<https://devfeed.tech/topics/python.md>)

Tags: [cloud](<https://devfeed.tech/tags/cloud.md>), [lua](<https://devfeed.tech/tags/lua.md>), [multi-tenancy](<https://devfeed.tech/tags/multi-tenancy.md>), [python](<https://devfeed.tech/tags/python.md>), [redis](<https://devfeed.tech/tags/redis.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

## AI overview

The article discusses multiple security vulnerabilities found and fixed in Redis's Lua subsystem, including issues in the cmsgpack and struct libraries. It explains that the vulnerabilities are especially relevant to cloud providers operating managed or multitenant Redis instances, while risk is more limited for users who control the data sent to their servers.

## Source excerpt

A bit more than one month ago I received an email from the Apple Information Security team. During an auditing the Apple team found a security issue in the Redis Lua subsystem, specifically in the cmsgpack library. The library is not part of Lua itself, it is an implementation of MessagePack I wrote myself. In the course of merging a pull request improving the feature set, a security issue was added. Later the same team found a new issue in the Lua struct library, again such library was not part of Lua itself, at least in the release of Lua we use: we just embedded the source code inside our Lua implementation in order to provide some functionality to the Lua interpreter that is available to Redis users. Then I found another issue in the same struct package, and later the Alibaba team found many other issues in cmsgpack and other code paths using the Lua API. In a short amount of time I was sitting on a pile of Lua related vulnerabilities. Those vulnerabilities are mostly relevant in the specific case of providing managed Redis severs on the cloud, because it is very unlikely that the vulnerabilities discovered can be used without direct access to the Redis server: many Redis users don't use the cmsgpack or the struct package at all, and who does will very unlikely feed them with untrusted input. However for cloud providers things are different: they have Redis instances, sometimes in multi tenancy setups, exposed to the user that subscribed for the service. She or he can send anything to such Redis instances, triggering the vulnerabilities, corrupting the memory, violating the Redis process, and potentially taking total control of the Redis process. For instance this simple Python program can crash Redis using one of the cmsgpack vunlerabilities [1]. [1] https://gist.github.com/antirez/82445fcbea6d9b19f97014cc6cc79f8a However from the point of view of normal Redis users that control what is sent to their instances, the risk is limited to feeding untrusted data to a