CVE-2020-14147

CWE-190 — Integer OverflowCWE-787 — Out-of-bounds Write11 documents9 sources
Severity
7.7HIGH
EPSS
0.3%
top 49.42%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Redislabs RedisDebian Debian LinuxOracle Communications Operations Monitor+1 more
Timeline
PublishedJun 15
Latest updateMay 24

Description

An integer overflow in the getnum function in lua_struct.c in Redis before 6.0.3 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow. NOTE: this issue exists because of a CVE-2015-8080 regression.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HExploitability: 3.1 | Impact: 4.0

Affected Packages3 packages

▶NVDredislabs/redis6.0.0 — 6.0.3+1
▶Debianredis< 5:6.0.0-1+3

Also affects: Debian Linux 10.0, Linux Enterprise 12.0

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-5q54-rrmc-9jrp: An integer overflow in the getnum function in lua_struct↗2022-05-24
▶
OSV
CVE-2020-14147: An integer overflow in the getnum function in lua_struct↗2020-06-15
▶
CVEList
CVE-2020-14147: An integer overflow in the getnum function in lua_struct↗2020-06-15
▶

📋Vendor Advisories

4
Oracle
Oracle Oracle Communications Risk Matrix: In-Memeory DB for FDP/VSP (Redis) — CVE-2020-14147↗2021-01-15
▶
Red Hat
redis: integer overflow in the getnum function in lua_struct.c could lead to a DoS↗2020-06-15
▶
Microsoft
An integer overflow in the getnum function in lua_struct.c in Redis before 6.0.3 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (mem↗2020-06-09
▶
Debian
CVE-2020-14147: redis - An integer overflow in the getnum function in lua_struct.c in Redis before 6.0.3...↗2020
▶

💬Community

3
Bugzilla
CVE-2020-14147 redis: integer overflow in the getnum function in lua_struct.c could lead to a DoS [epel-all]↗2020-06-18
▶
Bugzilla
CVE-2020-14147 redis: integer overflow in the getnum function in lua_struct.c could lead to a DoS [fedora-all]↗2020-06-18
▶
Bugzilla
CVE-2020-14147 redis: integer overflow in the getnum function in lua_struct.c could lead to a DoS↗2020-06-18
▶