CVE-2022-0543

Debian-specific Redis Server Lua Sandbox Escape

10.0 CRITICALActively exploited (CISA KEV)Public exploitEPSS 99.4%

Published18 Feb 2022
Added to CISA KEV28 Mar 2022
Remediation due18 Apr 2022

Description

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeChanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Redisall versions

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

Patch & vendor advisories

https://bugs.debian.org/1005787

References

http://packetstormsecurity.com/files/166885/Redis-Lua-Sandbox-Escape.htmlExploitThird Party AdvisoryVDB Entry
https://bugs.debian.org/1005787Issue TrackingPatchThird Party Advisory
https://lists.debian.org/debian-security-announce/2022/msg00048.htmlMailing ListThird Party Advisory
https://security.netapp.com/advisory/ntap-20220331-0004/Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0543US Government Resource
https://www.debian.org/security/2022/dsa-5081Mailing ListThird Party Advisory
https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rceThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2022-0543 being actively exploited?

Yes. CVE-2022-0543 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 28 Mar 2022.

How severe is CVE-2022-0543?

CVE-2022-0543 has a CVSS 3.1 base score of 10.0, rated critical. EPSS estimates a 99.4% probability of exploitation.

Which products are affected by CVE-2022-0543?

Affected products include Redis.

How do I fix CVE-2022-0543?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2022-0543 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.