Input validation error in Redis - CVE-2015-4335
Published: June 9, 2015 / Updated: August 4, 2020
Vulnerability identifier: #VU33828
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2015-4335
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
Affected software
Redis
Gentoo Linux
Fedora
redis (Alpine package)
redis
dev-db/redis
Gentoo Linux
Fedora
redis (Alpine package)
redis
dev-db/redis
How to mitigate CVE-2015-4335
Install update from vendor's website.
Redis - addressed in versions 2.8.21, 3.0.2
redis (Alpine package) - update to 2.8.21-r0
redis - addressed in versions 2.8.21-1.fc21, 2.8.21-1.fc22
dev-db/redis - update to 3.2.5
redis (Alpine package) - update to 2.8.21-r0
redis - addressed in versions 2.8.21-1.fc21, 2.8.21-1.fc22
dev-db/redis - update to 3.2.5
External References
- http://benmmurphy.github.io/blog/2015/06/04/redis-eval-lua-sandbox-escape/
- http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162094.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162146.html
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00014.html
- http://rhn.redhat.com/errata/RHSA-2015-1676.html
- http://www.debian.org/security/2015/dsa-3279
- http://www.openwall.com/lists/oss-security/2015/06/04/12
- http://www.openwall.com/lists/oss-security/2015/06/04/8
- http://www.openwall.com/lists/oss-security/2015/06/05/3
- http://www.securityfocus.com/bid/75034
- https://github.com/antirez/redis/commit/fdf9d455098f54f7666c702ae464e6ea21e25411
- https://groups.google.com/forum/#!msg/redis-db/4Y6OqK8gEyk/Dg-5cejl-eUJ
- https://security.gentoo.org/glsa/201702-16