[ CVE-2022-0543 · Published 18 Feb 2022 ]
Debian-specific Redis Server Lua Sandbox Escape Vulnerability
Exploited · CISA KEV CVSS 10.0
EPSS 99%Fix available
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-03-28
- EPSS: 99% chance of exploitation in the next 30 days (higher than 100% of CVEs)
- Critical severity: CVSS 10.0
[ Description ]Official description
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
CISA: Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 18 Apr 2022): Apply updates per vendor instructions.
- Patch on bugs.debian.orgVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
[ References ]References
- packetstormsecurity.com/files/166885/Redis-Lua-Sandbox-Escape.htmlExploitThird Party AdvisoryVDB Entry
- bugs.debian.org/1005787Issue TrackingPatchThird Party Advisory
- lists.debian.org/debian-security-announce/2022/msg00048.htmlMailing ListThird Party Advisory
- security.netapp.com/advisory/ntap-20220331-0004Third Party Advisory
- www.debian.org/security/2022/dsa-5081Mailing ListThird Party Advisory
- www.ubercomp.com/posts/2022-01-20_redis_on_debian_rceThird Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource