The vulnerability of the getnum() function implementation in the NoSQL Redis database management system allows a attacker to cause a service failure or execute arbitrary code.

🗓️ 08 Feb 2021 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 6 Views

Redis getnum has an integer overflow that can crash the service or enable code execution via Lua.

Reporter	Title	Published	Views	Family All 95
IBM Security Bulletins	Security Bulletin: Possible denial of service attack affecting Watson Knowledge Catalog for IBM Cloud Pak for Data	3 Aug 202016:22	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Redis, MinIO, Golang, and Urllib3 affect IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes and OpenShift	28 Jun 202120:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Streams is affected by a Redis vulnerability (CVE-2020-14147)	26 Sep 202019:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DataPower Gateway is potentially vulnerable to a Denial of Service (CVE-2020-14147)	8 Jun 202122:33	–	ibm
IBM Security Bulletins	Security Bulletin: Version 5.0.5 of Redis included in IBM Netcool Operations Insight 1.6.1.x has a security vulnerability (CVE-2020-14147)	29 Sep 202013:31	–	ibm
AlpineLinux	CVE-2020-14147	15 Jun 202016:52	–	alpinelinux
CBLMariner	CVE-2020-14147 affecting package redis 5.0.5-7	30 Nov 202019:30	–	cbl_mariner
CBLMariner	CVE-2020-14147 affecting package redis for versions less than 5.0.5-7	9 Apr 202206:51	–	cbl_mariner
CNVD	Redis Labs Redis Input Validation Error Vulnerability	16 Jun 202000:00	–	cnvd
CVE	CVE-2020-14147	15 Jun 202016:52	–	cve

Vulners

Node

oracle communications_operations_monitorMatch3.4

OR

novell suse_package_hub_for_suse_linux_enterpriseMatch12

OR

oracle communications_operations_monitorMatch4.2.0

OR

oracle communications_operations_monitorMatch4.3.0

OR

oracle communications_operations_monitorMatch4.1

OR

redis_labs redisRange<6.0.3

Source	Link
github	www.github.com/antirez/redis/commit/ef764dde1cca2f25d00686673d1bc89448819571
github	www.github.com/antirez/redis/pull/6875
oracle	www.oracle.com/security-alerts/cpujan2021.html
lists	www.lists.opensuse.org/opensuse-security-announce/2020-07/msg00058.html
debian	www.debian.org/security/2020/dsa-4731
web	www.web.nvd.nist.gov/view/vuln/detail

08 Feb 2021 00:00Current

7High risk

Vulners AI Score7

CVSS 26.8

CVSS 37.7

EPSS0.03085

redis getnum function integer overflow lua scripting code execution service failure