Redis string pattern matching can be abused to achieve Denial of Service
CVE-2022-36021

5.5MEDIUM

Key Information:

Vendor
Redis
Status
Redis
Vendor
CVE Published:
1 March 2023

Summary

Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like SCAN or KEYS) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. The problem is fixed in Redis versions 6.0.18, 6.2.11, 7.0.9.

Affected Version(s)

redis < 6.0.18 < 6.0.18

redis >= 6.2.0, < 6.2.11 < 6.2.0, 6.2.11

redis >= 7.0.0, < 7.0.9 < 7.0.0, 7.0.9

References

https://github.com/redis/redis/security/advisories/GHSA-j...
x_refsource_CONFIRM
https://github.com/redis/redis/commit/dcbfcb916ca1a269b3f...
x_refsource_MISC

EPSS Score

73% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.