Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-24736

Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. The problem is fixed in Redis versions 7.0.0 and 6.2.7. An additional workaround to mitigate this problem without patching the redis-server executable, if Lua scripting is not being used, is to block access to `SCRIPT LOAD` and `EVAL` commands using ACL rules.

Published

2022-04-27T20:15:09.857

Last Modified

2024-11-21T06:50:58.983

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 3.3 (LOW)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:N/I:N/A:P

  • Access Vector: LOCAL
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: PARTIAL
Exploitability Score

3.9

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-476
  • Type: Primary
    CWE-476
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application redis redis < 6.2.7 Yes
Application redis redis 7.0 Yes
Application redis redis 7.0 Yes
Application redis redis 7.0 Yes
Operating System fedoraproject fedora 34 Yes
Operating System fedoraproject fedora 35 Yes
Operating System fedoraproject fedora 36 Yes
Application netapp management_services_for_element_software - Yes
Application netapp management_services_for_netapp_hci - Yes
Application oracle communications_operations_monitor 4.3 Yes
Application oracle communications_operations_monitor 4.4 Yes
Application oracle communications_operations_monitor 5.0 Yes
References