CVE-2022-0543
CriticalActively exploited (CISA KEV)
Description
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
SeverityCritical
CVSS10.0
Exploit probability100. percentile99.4%
Product
Redis Debian-specific Redis Servers
PublishedFeb 18, 2022
First seenFeb 18, 2022
Added to KEVMar 28, 2022
Weakness typeCWE-862Missing authorization
How to fix
CISA required action
Apply updates per vendor instructions.
CISA due date: Apr 18, 2022Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redis redis | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.