CVE-2022-0543

Warning

Exploit

EPSS 94.42%
Published 18.02.2022 20:15:17
Last modified 02.04.2025 20:22:56
Source security@debian.org
Teams watchlist Login
Open Login

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.

Affected products Warnungen 1 Metrics 4 CWE 1 References 9

Data is provided by the National Vulnerability Database (NVD)

Redis ≫ Redis Version-

   Canonical ≫ Ubuntu Linux Version20.04 SwEditionlts
   Canonical ≫ Ubuntu Linux Version21.10 SwEdition-
   Debian ≫ Debian Linux Version9.0
   Debian ≫ Debian Linux Version10.0
   Debian ≫ Debian Linux Version11.0

28.03.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog

Debian-specific Redis Server Lua Sandbox Escape Vulnerability

Vulnerability

Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.

Description

Apply updates per vendor instructions.

Required actions

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	94.42%	1

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	10	3.9	6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
nvd@nist.gov	10	10	10	AV:N/AC:L/Au:N/C:C/I:C/A:C
134c704f-9b21-4f2e-91b3-4a467353bcc0	10	3.9	6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H