CVE-2022-31144

2022-07-1921:15:15

CWE-787

CWE-122

[email protected]

web.nvd.nist.gov

cve-2022-31144

redis

in-memory database

heap overflow

remote code execution

xautoclaim

nvd

security vulnerability

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.8 High

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

78.5%

JSON

Redis is an in-memory database that persists on disk. A specially crafted XAUTOCLAIM command on a stream key in a specific state may result with heap overflow, and potentially remote code execution. This problem affects versions on the 7.x branch prior to 7.0.4. The patch is released in version 7.0.4.

Affected configurations

Vulners

NVD

Node

redisredisRange7.0.0–7.0.4

VendorProductVersionCPE
redisredis*cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redis	redis	*	cpe:2.3:a:redis:redis::::::::

CNA Affected

[
  {
    "product": "redis",
    "vendor": "redis",
    "versions": [
      {
        "status": "affected",
        "version": ">= 7.0.0, < 7.0.4"
      }
    ]
  }
]