CVE-2022-0543
CRITICALCVSS 10/10Actively ExploitedEPSS 99.67%
Last modified
CVE-2022-0543 is a critical-severity vulnerability rated 10/10 on the CVSS scale. It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.. CISA has confirmed active exploitation in the wild. EPSS estimates a 99.67% chance of exploitation in the next 30 days.
Description
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
Metrics
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Redis | Redis | All versions |
References
- https://packetstormsecurity.com/files/166885/Redis-Lua-Sandbox-Escape.htmlExploit, Third Party Advisory, VDB Entry
- https://bugs.debian.org/1005787Issue Tracking, Patch, Third Party Advisory
- https://lists.debian.org/debian-security-announce/2022/msg00048.htmlMailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220331-0004/Third Party Advisory
- https://www.debian.org/security/2022/dsa-5081Mailing List, Third Party Advisory
- https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rceThird Party Advisory
- https://packetstormsecurity.com/files/166885/Redis-Lua-Sandbox-Escape.htmlExploit, Third Party Advisory, VDB Entry
- https://bugs.debian.org/1005787Issue Tracking, Patch, Third Party Advisory
- https://lists.debian.org/debian-security-announce/2022/msg00048.htmlMailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220331-0004/Third Party Advisory
- https://www.debian.org/security/2022/dsa-5081Mailing List, Third Party Advisory
- https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rceThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0543US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2022-0543?
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
How severe is CVE-2022-0543?
CVE-2022-0543 has a CVSS score of 10/10 (CRITICAL severity). The EPSS model estimates a 99.67% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
How do I fix CVE-2022-0543?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-0537The MapPress Maps for WordPress plugin before 2.73.13 allows…7.2
- CVE-2022-0538Jenkins 2.333 and earlier, LTS 2.319.2 and earlier defines c…7.5
- CVE-2022-0539Cross-site Scripting (XSS) - Stored in Packagist ptrofimov/b…5.4
- CVE-2022-0540A vulnerability in Jira Seraph allows a remote, unauthentica…9.8
- CVE-2022-0541The flo-launch WordPress plugin before 2.4.1 injects code in…9.8
- CVE-2022-0542Cross-site Scripting (XSS) - DOM in GitHub repository chatwo…6.1
- CVE-2022-0544An integer underflow in the DDS loader of Blender leads to a…5.5
- CVE-2022-0545An integer overflow in the processing of loaded 2D images le…7.8
- CVE-2022-0546A missing bounds check in the image loader used in Blender 3…7.8
- CVE-2022-0547OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authenticati…9.8
- CVE-2022-0549An issue has been discovered in GitLab CE/EE affecting all v…6.5
- CVE-2022-0550Improper Input Validation vulnerability in custom report log…7.2
Are you affected by CVE-2022-0543?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST