CVE-2022-31144 Potential heap overflow in Redis

2022-07-1920:15:13

CWE-122

GitHub_M

www.cve.org

redis

heap overflow

potential remote code execution

xautoclaim command

7.x branch

patch

version 7.0.4

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

9.1

Confidence

High

EPSS

0.008

Percentile

82.5%

JSON

Redis is an in-memory database that persists on disk. A specially crafted XAUTOCLAIM command on a stream key in a specific state may result with heap overflow, and potentially remote code execution. This problem affects versions on the 7.x branch prior to 7.0.4. The patch is released in version 7.0.4.

CNA Affected

[
  {
    "product": "redis",
    "vendor": "redis",
    "versions": [
      {
        "status": "affected",
        "version": ">= 7.0.0, < 7.0.4"
      }
    ]
  }
]