CVE-2022-36021
Redis string pattern matching can be abused to achieve Denial of Service
Summary
Redis string pattern matching can be abused to achieve Denial of Service
Original description
The description as published by the source.
Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like SCAN or KEYS) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. The problem is fixed in Redis versions 6.0.18, 6.2.11, 7.0.9.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
keydb
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.0.18"},{"introduced":"6.2.0"},{"fixed":"6.2.11"},{"introduced":"7.0.0"},{"fixed":"7.0.9"}]}]
Bitnami
redis
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.0.18"},{"introduced":"6.2.0"},{"fixed":"6.2.11"},{"introduced":"7.0.0"},{"fixed":"7.0.9"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2022-36021 redis Fixed in: 5:6.0.16-1+deb11u3
References
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- patch github.com