Back to overview

CVE-2022-0543

CRITICAL KEV CISA Exploitation: ACTIVE
10.0
CVSS 3.1
Description
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.

Metadata

CVE ID
CVE-2022-0543
State
PUBLISHED
Assigner
debian
Reserved
2022-02-08 00:00 UTC
Published
2022-02-18 19:25 UTC
Last updated
2025-10-21 23:15 UTC
Primary CWE
CWE-862
CWE-862 Missing Authorization
Vendor / Product
Debian / redis
Sources
cve.org  ·  NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
ACTIVE
Automatable
yes
Tech. Impact
total
CISA Known Exploited Vulnerability
Vulnerability name
Debian-specific Redis Server Lua Sandbox Escape Vulnerability
Vendor
Redis
Product
Debian-specific Redis Servers
Added to KEV
2022-03-28
Due date
2022-04-18
Ransomware
Not known
Required action
Apply updates per vendor instructions.
CISA description
Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
Affected products (1)
VendorProductPlatformVersions
Debian redis — n/a
Weakness (CWE)
CWESourceDescription
— cna Lua sandbox escape
CWE-862 adp CWE-862 Missing Authorization
CVSS scores (1)
ScoreSeverityVersionSourceVector
10.0 CRITICAL 3.1 adp CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References (6)
Back to overview