Vulnerability · Published Sep 23, 2022 · Assigned by GitHub_M
CVE-2022-35951Redis subject to Integer Overflow leading to Remote Code Execution via Heap Overflow
High 7.0
In plain English
A high-severity integer overflow in redis from redis. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.9% (higher than 90% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Redis is an in-memory database that persists on disk. Versions 7.0.0 and above, prior to 7.0.5 are vulnerable to an Integer Overflow. Executing an `XAUTOCLAIM` command on a stream key in a specific state, with a specially crafted `COUNT` argument may cause an integer overflow, a subsequent heap overflow, and potentially lead to remote code execution. This has been patched in Redis version 7.0.5. No known workarounds exist.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | redis | 7.0.5-r0 | ALPINE-CVE-2022-35951 |
| Alpine:v3.21 | redis | 7.0.5-r0 | ALPINE-CVE-2022-35951 |
| Alpine:v3.22 | redis | 7.0.5-r0 | ALPINE-CVE-2022-35951 |
| Alpine:v3.23 | redis | 7.0.5-r0 | ALPINE-CVE-2022-35951 |
| Alpine:v3.24 | redis | 7.0.5-r0 | ALPINE-CVE-2022-35951 |
| Debian:12 | redis | 5:7.0.5-1 | DEBIAN-CVE-2022-35951 |
| Debian:13 | redis | 5:7.0.5-1 | DEBIAN-CVE-2022-35951 |
| Debian:14 | redis | 5:7.0.5-1 | DEBIAN-CVE-2022-35951 |
| Ubuntu:24.04:LTS | redis | 5:7.0.12-1 | UBUNTU-CVE-2022-35951 |
Affected products (as reported)
Weakness: CWE-190 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H