critical 10.0

CVE-2022-0543 kev in the critical feed json

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escap…

published 2022-02-18 4y ago modified 2026-06-17 4mo ago also BIT-redis-2022-0543 , EUVD-2022-15665

cvss: 10.0; version 3.1, CNA
cisa kev: Exploited; added 2022-03-28
epss: 99.4%; EPSS 99.4% chance of exploitation in 30 days, percentile 99.9%
public exploits: 1; Metasploit, plus a Nuclei check

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.

Patch / fix

cisa required action Apply updates per vendor instructions.

distros 2 links 1

debian ubuntu

redis Debian 14, Debian 13, Debian 12 5:6.0.16-2

debian advisories DEBIAN-CVE-2022-0543

redis Ubuntu 20.04 LTS 5:5.0.7-2ubuntu0.1

ubuntu advisories UBUNTU-CVE-2022-0543

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

bugs.debian.org/1005787 advisory

Is CVE-2022-0543 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Timeline

2022-02-18 First public exploit (Metasploit exploit/linux/redis/redis_debian_sandbox_escape)
2022-02-18 Published
2022-03-28 Added to CISA KEV
2022-04-18 CISA patch deadline
2025-01-29 CISA SSVC: exploitation active

Known exploited

Added: 4y ago (2022-03-28)
Patch by: 2022-04-18 (4y ago)
Ransomware: Not known
Required action: Apply updates per vendor instructions.
Vendor, product: Redis, Debian-specific Redis Servers
CISA name: Debian-specific Redis Server Lua Sandbox Escape Vulnerability

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: yes
Technical impact: total
Assessed: last yr. (2025-01-29)

Exploit prediction

99.35% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit exploit/linux/redis/redis_debian_sandbox_escape Redis Lua Sandbox Escape metasploit exploit, excellent rank, 2022-02-18
Nuclei template Redis Sandbox Escape - Remote Code Execution nuclei detection template
packetstormsecurity.com http://packetstormsecurity.com/files/166885/Redis-Lua-Sandbox-Escape.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD	3.1	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CNA	3.1	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD	2.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C
OSV	3.1	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
bitnami	redis	—	no fix listed

Affected products

Debian redis

Classification

Weakness

CWE-862 Missing Authorization

Technology feeds

Redis rss critical rss

References

bugs.debian.org /1005787
issue-tracking, patch, third-party-advisory, web
packetstormsecurity.com /files/166885/Redis-Lua-Sandbox-Escape.html
exploit, third-party-advisory, vdb-entry, web
debian.org /security/2022/dsa-5081
vendor-advisory, mailing-list, third-party-advisory, web
ubercomp.com /posts/2022-01-20_redis_on_debian_rce
third-party-advisory, web
lists.debian.org /debian-security-announce/2022/msg00048.html
mailing-list, third-party-advisory, web
security.netapp.com /advisory/ntap-20220331-0004/
third-party-advisory, web
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0543
government-resource, us-government-resource

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.