CVE-2022-35977
mediumPriorität · verfolgen · 27EPSS 0.135 · 96. PerzentilDEEURUUSEPSS · bewertet 2026-10-27
Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SETRANGE` and `SORT(_RO)` commands can trigger an integer overflow, resulting with Redis attempting to allocate impossible amounts of memory and abort with an out-of-memory (OOM) panic. The problem is fixed in Redis versions 7.0.8, 6.2.9 and 6.0.17. Users are advised to upgrade. There are no known workarounds for this vulnerability.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (57)
Betroffene Produkte und Versionsbereiche.
Advisories (4)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2023-0102Redis: Mehrere Schwachstellen ermöglichen Denial of ServiceDeutsch2023-01-16csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Redis ausnutzen, um einen Denial of Service Angriff durchzuführen.
- BIT-keydb-2022-35977Integer overflow in certain command arguments can drive Redis to OOM panic2024-08-22vendor · osvUS
Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SETRANGE` and `SORT(_RO)` commands can trigger an integer overflow, resulting with Redis attempting to allocate impossible amounts of memory and abort with an out-of-memory (OOM) panic. The problem is fixed in Redis versions 7.0.8, 6.2.9 and 6.0.17. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- BIT-redis-2022-35977Integer overflow in certain command arguments can drive Redis to OOM panic2024-03-06vendor · osvUS
Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SETRANGE` and `SORT(_RO)` commands can trigger an integer overflow, resulting with Redis attempting to allocate impossible amounts of memory and abort with an out-of-memory (OOM) panic. The problem is fixed in Redis versions 7.0.8, 6.2.9 and 6.0.17. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- BIT-valkey-2022-35977Integer overflow in certain command arguments can drive Redis to OOM panic2024-08-22vendor · osvUS
Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SETRANGE` and `SORT(_RO)` commands can trigger an integer overflow, resulting with Redis attempting to allocate impossible amounts of memory and abort with an out-of-memory (OOM) panic. The problem is fixed in Redis versions 7.0.8, 6.2.9 and 6.0.17. Users are advised to upgrade. There are no known workarounds for this vulnerability.
auch bekannt als (7)
Weitere Namen und Kennungen dieser Entität.
- CNNVD-202301-1616cnnvd
- EUVD-2022-38804enisa_euvd
- BDU:2023-00695fstec_bdu
- BIT-keydb-2022-35977osv
- BIT-redis-2022-35977osv
- BIT-valkey-2022-35977osv
- GHSA-mrcw-fhw9-fj8josv
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (19)
Externe Belege — Patches, Meldungen, Analysen.
- https://cxsecurity.com/cveshow/CVE-2022-35977/cnnvd
- https://github.com/redis/redis/commit/1ec82e6e97e1db06a72ca505f9fbf6b981f31ef7cnnvd
- https://github.com/redis/redis/releases/tag/6.0.17cnnvd
- https://github.com/redis/redis/releases/tag/6.2.9cnnvd
- https://github.com/redis/redis/releases/tag/7.0.8cnnvd
- https://github.com/redis/redis/security/advisories/GHSA-mrcw-fhw9-fj8jcnnvd
- https://www.auscert.org.au/bulletins/ESB-2023.0736cnnvd
- https://www.auscert.org.au/bulletins/ESB-2023.7257cnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan