[SECURITY] [DSA 5081-1] redis security update

2022-02-1819:05:16

lists.debian.org

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.971 High

EPSS

Percentile

99.8%

JSON

Debian Security Advisory DSA-5081-1 [email protected]
https://www.debian.org/security/ Moritz Muehlenhoff
February 18, 2022 https://www.debian.org/security/faq

Package : redis
CVE ID : CVE-2022-0543
Debian Bug : 1005787

Reginaldo Silva discovered a (Debian-specific) Lua sandbox escape in
Redis, a persistent key-value database.

For the oldstable distribution (buster), this problem has been fixed
in version 5:5.0.14-1+deb10u2.

For the stable distribution (bullseye), this problem has been fixed in
version 5:6.0.16-1+deb11u2.

We recommend that you upgrade your redis packages.

For the detailed security status of redis please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/redis

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian11s390xredis-tools< 5:6.0.16-1+deb11u2redis-tools_5:6.0.16-1+deb11u2_s390x.deb
Debian11amd64redis-tools-dbgsym< 5:6.0.16-1+deb11u2redis-tools-dbgsym_5:6.0.16-1+deb11u2_amd64.deb
Debian10amd64redis-tools-dbgsym< 5:5.0.14-1+deb10u2redis-tools-dbgsym_5:5.0.14-1+deb10u2_amd64.deb
Debian10amd64redis-tools< 5:5.0.14-1+deb10u2redis-tools_5:5.0.14-1+deb10u2_amd64.deb
Debian10armelredis-server< 5:5.0.14-1+deb10u2redis-server_5:5.0.14-1+deb10u2_armel.deb
Debian10ppc64elredis-tools< 5:5.0.14-1+deb10u2redis-tools_5:5.0.14-1+deb10u2_ppc64el.deb
Debian10armhfredis-sentinel< 5:5.0.14-1+deb10u2redis-sentinel_5:5.0.14-1+deb10u2_armhf.deb
Debian11armhfredis-tools-dbgsym< 5:6.0.16-1+deb11u2redis-tools-dbgsym_5:6.0.16-1+deb11u2_armhf.deb
Debian10i386redis-tools-dbgsym< 5:5.0.14-1+deb10u2redis-tools-dbgsym_5:5.0.14-1+deb10u2_i386.deb
Debian10mipsredis-tools-dbgsym< 5:5.0.14-1+deb10u2redis-tools-dbgsym_5:5.0.14-1+deb10u2_mips.deb

OS	Version	Architecture	Package	Version	Filename
Debian	11	s390x	redis-tools	< 5:6.0.16-1+deb11u2	redis-tools_5:6.0.16-1+deb11u2_s390x.deb
Debian	11	amd64	redis-tools-dbgsym	< 5:6.0.16-1+deb11u2	redis-tools-dbgsym_5:6.0.16-1+deb11u2_amd64.deb
Debian	10	amd64	redis-tools-dbgsym	< 5:5.0.14-1+deb10u2	redis-tools-dbgsym_5:5.0.14-1+deb10u2_amd64.deb
Debian	10	amd64	redis-tools	< 5:5.0.14-1+deb10u2	redis-tools_5:5.0.14-1+deb10u2_amd64.deb
Debian	10	armel	redis-server	< 5:5.0.14-1+deb10u2	redis-server_5:5.0.14-1+deb10u2_armel.deb
Debian	10	ppc64el	redis-tools	< 5:5.0.14-1+deb10u2	redis-tools_5:5.0.14-1+deb10u2_ppc64el.deb
Debian	10	armhf	redis-sentinel	< 5:5.0.14-1+deb10u2	redis-sentinel_5:5.0.14-1+deb10u2_armhf.deb
Debian	11	armhf	redis-tools-dbgsym	< 5:6.0.16-1+deb11u2	redis-tools-dbgsym_5:6.0.16-1+deb11u2_armhf.deb
Debian	10	i386	redis-tools-dbgsym	< 5:5.0.14-1+deb10u2	redis-tools-dbgsym_5:5.0.14-1+deb10u2_i386.deb
Debian	10	mips	redis-tools-dbgsym	< 5:5.0.14-1+deb10u2	redis-tools-dbgsym_5:5.0.14-1+deb10u2_mips.deb