Redis string pattern matching can be abused to achieve Denial of Service
Résumé
Redis string pattern matching can be abused to achieve Denial of Service
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like SCAN or KEYS) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. The problem is fixed in Redis versions 6.0.18, 6.2.11, 7.0.9.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2022-36021 redis Corrigé dans: 5:6.0.16-1+deb11u3
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- patch github.com