⚠ Actively exploited
Added to CISA KEV on 2022-03-28. Federal agencies required to patch by 2022-04-18. Required action: Apply updates per vendor instructions..
CVE-2022-0543 — Missing Authorization in Redis
Severity
10.0CRITICALNVD
CISA7.8
EPSS
94.4%
top 0.02%
CISA KEV
KEV
Added 2022-03-28
Due 2022-04-18
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedFeb 18
KEV addedMar 28
KEV dueApr 18
Latest updateJan 27
CISA Required Action: Apply updates per vendor instructions.
Description
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HExploitability: 3.9 | Impact: 6.0
Affected Packages3 packages
Patches
🔴Vulnerability Details
3GHSA▶
GHSA-9wpj-h5jq-88p9: It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which co↗2022-02-19
OSV▶
CVE-2022-0543: It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which co↗2022-02-18
💥Exploits & PoCs
2Nuclei▶
Redis Sandbox Escape - Remote Code Execution
🔍Detection Rules
4Suricata
▶
📋Vendor Advisories
4Debian▶
CVE-2022-0543: redis - It was discovered, that redis, a persistent key-value database, due to a packagi...↗2022