CVE-2022-35951
criticalPriorität · verfolgen · 40EPSS 0.039 · 90. PerzentilEURUUSEPSS · bewertet 2026-10-27
Redis is an in-memory database that persists on disk. Versions 7.0.0 and above, prior to 7.0.5 are vulnerable to an Integer Overflow. Executing an `XAUTOCLAIM` command on a stream key in a specific state, with a specially crafted `COUNT` argument may cause an integer overflow, a subsequent heap overflow, and potentially lead to remote code execution. This has been patched in Redis version 7.0.5. No known workarounds exist.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 7–9.8
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (11)
Betroffene Produkte und Versionsbereiche.
Advisories (3)
Hersteller- und Ökosystem-Meldungen dazu.
- BIT-keydb-2022-35951Redis subject to Integer Overflow leading to Remote Code Execution via Heap Overflow2024-08-22vendor · osvUS
Redis is an in-memory database that persists on disk. Versions 7.0.0 and above, prior to 7.0.5 are vulnerable to an Integer Overflow. Executing an `XAUTOCLAIM` command on a stream key in a specific state, with a specially crafted `COUNT` argument may cause an integer overflow, a subsequent heap overflow, and potentially lead to remote code execution. This has been patched in Redis version 7.0.5. No known workarounds exist.
- BIT-redis-2022-35951Redis subject to Integer Overflow leading to Remote Code Execution via Heap Overflow2024-03-06vendor · osvUS
Redis is an in-memory database that persists on disk. Versions 7.0.0 and above, prior to 7.0.5 are vulnerable to an Integer Overflow. Executing an `XAUTOCLAIM` command on a stream key in a specific state, with a specially crafted `COUNT` argument may cause an integer overflow, a subsequent heap overflow, and potentially lead to remote code execution. This has been patched in Redis version 7.0.5. No known workarounds exist.
- BIT-valkey-2022-35951Redis subject to Integer Overflow leading to Remote Code Execution via Heap Overflow2024-08-22vendor · osvUS
Redis is an in-memory database that persists on disk. Versions 7.0.0 and above, prior to 7.0.5 are vulnerable to an Integer Overflow. Executing an `XAUTOCLAIM` command on a stream key in a specific state, with a specially crafted `COUNT` argument may cause an integer overflow, a subsequent heap overflow, and potentially lead to remote code execution. This has been patched in Redis version 7.0.5. No known workarounds exist.
auch bekannt als (7)
Weitere Namen und Kennungen dieser Entität.
- CNNVD-202209-2343cnnvd
- EUVD-2022-38797enisa_euvd
- BDU:2022-05912fstec_bdu
- BIT-keydb-2022-35951osv
- BIT-redis-2022-35951osv
- BIT-valkey-2022-35951osv
- GHSA-5gc4-76rx-22c9osv
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (15)
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/security/cve/cve-2022-35951cnnvd
- https://cxsecurity.com/cveshow/CVE-2022-35951/cnnvd
- https://github.com/redis/redis/security/advisories/GHSA-5gc4-76rx-22c9cnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A7INCOOFPPEAKNDBZU3TIZJPYXBULI2C/cnnvd
- https://packetstormsecurity.com/files/168568/Gentoo-Linux-Security-Advisory-202209-17.htmlcnnvd
- https://security.gentoo.org/glsa/202209-17cnnvd
- https://security.netapp.com/advisory/ntap-20221020-0005/cnnvd
- https://github.com/redis/redis/security/advisories/GHSA-5gc4-76rx-22c9enisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan