Description
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Debian redis
n/aaffected
References
- https://bugs.debian.org/1005787 ↗
- https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rce ↗
- https://lists.debian.org/debian-security-announce/2022/msg00048.html ↗
- https://www.debian.org/security/2022/dsa-5081 ↗
- https://security.netapp.com/advisory/ntap-20220331-0004/ ↗
- http://packetstormsecurity.com/files/166885/Redis-Lua-Sandbox-Escape.html ↗
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0543 ↗