CVE-2022-24735 Lua scripts can be manipulated to overcome ACL rules in Redis

Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis prior to version 7.0.0 or 6.2.7 can inject Lua code that will execute with the potentially higher privileges of another Redis user. The Lua scri...

Redis Labs Redis 代码注入漏洞

Redis Labs Redis is the United States Redis Labs, Inc. of a set of open-source use of ANSI C written to support the network , can be based on the memory can also be a persistent log-type , key-value Key-Value storage database , and provides a variety of languages API. An injection vulnerability...

redis -- Multiple vulnerabilities

Aviv Yahav reports: CVE-2022-24735 By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis can inject Lua code that will execute with the potentially higher privileges of another Redis user. CVE-2022-24736 An attacker attempting to load a specially craft...

Redis Lua Sandbox Escape

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Redis Lua Sandbox Escape', 'Description' = %q This module exploits CVE-2022-0543, a Lua-based Redis sandbox escape. The vulnerability was...

Redis Lua Sandbox Escape Exploit

This Metasploit module exploits CVE-2022-0543, a Lua-based Redis sandbox escape. The vulnerability was introduced by Debian and Ubuntu Redis packages that insufficiently sanitized the Lua environment. The maintainers failed to disable the package interface, allowing attackers to load arbitrary...

Redis Labs Redis 代码问题漏洞

Redis Labs Redis is the United States Redis Labs, Inc. of a set of open-source use of ANSI C written to support the network , can be based on the memory can also be a persistent log-type , key-value Key-Value storage database , and provides a variety of languages API. A security vulnerability...

PT-2022-2525

Name of the Vulnerable Software and Affected Versions Redis versions prior to 6.2.7 and 7.0.0 Description The issue is related to errors in pointer dereferencing. An attacker can exploit this by loading a specially crafted Lua script, causing a NULL pointer dereference that results in a crash of...

GHSA-V2WF-C3J6-WPVW Session fixation

Impact The use of Plug.Session in Pow.Plug.Session is susceptible to session fixation attacks if a persistent session store is used for Plug.Session, such as Redis or a database. Cookie store, which is used in most Phoenix apps, doesn't have this vulnerability. Workarounds Call...

CVE-2021-32627 affecting package redis for versions less than 6.2.6-1

CVE-2021-32627 affecting package redis for versions less than 6.2.6-1. An upgraded version of the package is available that resolves this issue...

CVE-2021-41099 affecting package redis for versions less than 6.2.6-1

CVE-2021-41099 affecting package redis for versions less than 6.2.6-1. An upgraded version of the package is available that resolves this issue...

CVE-2021-32762 affecting package redis for versions less than 6.2.6-1

CVE-2021-32762 affecting package redis for versions less than 6.2.6-1. An upgraded version of the package is available that resolves this issue...

CVE-2021-32626 affecting package redis for versions less than 6.2.6-1

CVE-2021-32626 affecting package redis for versions less than 6.2.6-1. An upgraded version of the package is available that resolves this issue...

CVE-2021-32687 affecting package redis for versions less than 6.2.6-1

CVE-2021-32687 affecting package redis for versions less than 6.2.6-1. An upgraded version of the package is available that resolves this issue...

CVE-2021-21309 affecting package redis for versions less than 5.0.5-7

CVE-2021-21309 affecting package redis for versions less than 5.0.5-7. A patched version of the package is available...

CVE-2020-14147 affecting package redis for versions less than 5.0.5-7

CVE-2020-14147 affecting package redis for versions less than 5.0.5-7. A patched version of the package is available...

CVE-2021-3470 affecting package redis for versions less than 5.0.5-7

CVE-2021-3470 affecting package redis for versions less than 5.0.5-7. A patched version of the package is available...

CVE-2021-32675 affecting package redis for versions less than 6.2.6-1

CVE-2021-32675 affecting package redis for versions less than 6.2.6-1. An upgraded version of the package is available that resolves this issue...

CVE-2021-32628 affecting package redis for versions less than 6.2.6-1

CVE-2021-32628 affecting package redis for versions less than 6.2.6-1. An upgraded version of the package is available that resolves this issue...

CVE-2021-32672 affecting package redis for versions less than 6.2.6-1

CVE-2021-32672 affecting package redis for versions less than 6.2.6-1. An upgraded version of the package is available that resolves this issue...

CVE-2021-32761 affecting package redis for versions less than 6.2.5-1

CVE-2021-32761 affecting package redis for versions less than 6.2.5-1. An upgraded version of the package is available that resolves this issue...