CVE-2015-4335 Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
HighCVSS 10.0
EPSS 9.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/redis(Debian:12) | < 2:3.0.2-1 | 2:3.0.2-1 |
| debian/redis(Debian:13) | < 2:3.0.2-1 | 2:3.0.2-1 |
| debian/redis(Debian:14) | < 2:3.0.2-1 | 2:3.0.2-1 |
| redislabs redis | <= 2.8.20 | No fix listed |
| redislabs redis | = 3.0.0 | No fix listed |
| redislabs redis | = 3.0.1 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
References
- Debian Security Tracker CVE-2015-4335 vendor-advisory
- benmmurphy.github.io exploit third-party-advisory
- FEDORA-2015-9488 third-party-advisory vendor-advisory
- FEDORA-2015-9498 third-party-advisory vendor-advisory
- openSUSE-SU-2015:1687 third-party-advisory vendor-advisory
- RHSA-2015:1676 third-party-advisory vendor-advisory
- DSA-3279 third-party-advisory vendor-advisory
- [oss-security] 20150604 Re: CVE Request: redis Lua sandbox escape and arbitrary code execution mailing-list third-party-advisory
- [oss-security] 20150604 CVE Request: redis Lua sandbox escape and arbitrary code execution mailing-list third-party-advisory
- [oss-security] 20150605 Re: CVE Request: redis Lua sandbox escape and arbitrary code execution mailing-list third-party-advisory
- 75034 third-party-advisory vdb-entry
- github.com third-party-advisory
- groups.google.com
- GLSA-201702-16 third-party-advisory vendor-advisory