BIT-redis-2022-31144

vendorUSosv

Potential heap overflow in Redis

view advisory published 2024-03-06Licence: per source

Redis is an in-memory database that persists on disk. A specially crafted `XAUTOCLAIM` command on a stream key in a specific state may result with heap overflow, and potentially remote code execution. This problem affects versions on the 7.x branch prior to 7.0.4. The patch is released in version 7.0.4.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-31144US	high8.8	3.24% (88th)	Exploit	2022-07-19
Redis is an in-memory database that persists on disk. A specially crafted `XAUTOCLAIM` command on a stream key in a specific state may result with heap overflow, and potentially re…

references

External citations — patches, advisories, analysis.

https://github.com/redis/redis/releases/tag/7.0.4ADVISORY
https://github.com/redis/redis/security/advisories/GHSA-96f7-42fg-2jrhADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2022-31144WEB
https://security.gentoo.org/glsa/202209-17ADVISORY
https://security.netapp.com/advisory/ntap-20220909-0002/ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan