Redis · Debian-specific Redis Servers
CVE-2022-0543
Debian-specific Redis Server Lua Sandbox Escape Vulnerability
Exploited in attacks
Critical 10.0 Attack chance: 99.4%
What it is
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
CISA: Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: April 18, 2022
- Added to the CISA list
- March 28, 2022
- Published
- February 18, 2022
- Severity
- Critical 10.0 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 99.4% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-862
- More details
- NVD · CVE.org · CISA
All references (6)
- https://www.debian.org/security/2022/dsa-5081
- https://bugs.debian.org/1005787
- https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rce
- https://lists.debian.org/debian-security-announce/2022/msg00048.html
- https://security.netapp.com/advisory/ntap-20220331-0004/
- http://packetstormsecurity.com/files/166885/Redis-Lua-Sandbox-Escape.html
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.