It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
References
Link | Resource |
---|---|
http://packetstormsecurity.com/files/166885/Redis-Lua-Sandbox-Escape.html | Exploit Third Party Advisory VDB Entry |
https://bugs.debian.org/1005787 | Issue Tracking Patch Third Party Advisory |
https://lists.debian.org/debian-security-announce/2022/msg00048.html | Mailing List Third Party Advisory |
https://security.netapp.com/advisory/ntap-20220331-0004/ | Third Party Advisory |
https://www.debian.org/security/2022/dsa-5081 | Mailing List Third Party Advisory |
https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rce | Third Party Advisory |
Configurations
Configuration 1 (hide)
AND |
|
History
29 Sep 2023, 15:55
Type | Values Removed | Values Added |
---|---|---|
First Time |
Canonical ubuntu Linux
Canonical |
|
CPE | cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* cpe:2.3:o:canonical:ubuntu_linux:21.10:*:*:*:-:*:*:* |
|
References | (MISC) http://packetstormsecurity.com/files/166885/Redis-Lua-Sandbox-Escape.html - Exploit, Third Party Advisory, VDB Entry |
08 Aug 2023, 14:22
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-862 |
05 Jun 2022, 02:35
Type | Values Removed | Values Added |
---|---|---|
References | (CONFIRM) https://security.netapp.com/advisory/ntap-20220331-0004/ - Third Party Advisory | |
References | (MISC) http://packetstormsecurity.com/files/166885/Redis-Lua-Sandbox-Escape.html - Exploit, Third Party Advisory |
27 Apr 2022, 21:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
31 Mar 2022, 09:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
09 Mar 2022, 02:03
Type | Values Removed | Values Added |
---|---|---|
CWE | NVD-CWE-noinfo | |
CPE | cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* cpe:2.3:a:redis:redis:-:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
|
CVSS |
v2 : v3 : |
v2 : 10.0
v3 : 10.0 |
First Time |
Debian debian Linux
Debian Redis redis Redis |
|
References | (MLIST) https://lists.debian.org/debian-security-announce/2022/msg00048.html - Mailing List, Third Party Advisory | |
References | (MISC) https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rce - Third Party Advisory | |
References | (DEBIAN) https://www.debian.org/security/2022/dsa-5081 - Mailing List, Third Party Advisory | |
References | (MISC) https://bugs.debian.org/1005787 - Issue Tracking, Patch, Third Party Advisory |
18 Feb 2022, 20:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-02-18 20:15
Updated : 2023-12-10 14:22
NVD link : CVE-2022-0543
Mitre link : CVE-2022-0543
CVE.ORG link : CVE-2022-0543
JSON object : View
Products Affected
canonical
- ubuntu_linux
redis
- redis
debian
- debian_linux
CWE
CWE-862
Missing Authorization