CVE-2022-0543

CriticalCVSS 10.0/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Debian	redis	n/a

References

http://packetstormsecurity.com/files/166885/Redis-Lua-Sandbox-Escape.htmlExploit, Third Party Advisory, VDB Entry
https://bugs.debian.org/1005787Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-security-announce/2022/msg00048.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20220331-0004/Third Party Advisory
https://www.debian.org/security/2022/dsa-5081Mailing List, Third Party Advisory
https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rceThird Party Advisory
http://packetstormsecurity.com/files/166885/Redis-Lua-Sandbox-Escape.htmlExploit, Third Party Advisory, VDB Entry
https://bugs.debian.org/1005787Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-security-announce/2022/msg00048.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20220331-0004/Third Party Advisory
https://www.debian.org/security/2022/dsa-5081Mailing List, Third Party Advisory
https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rceThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0543US Government Resource

Timeline

Published: Feb 18, 2022
Last modified: Jun 17, 2026
Added to CISA KEV: Mar 28, 2022
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-05445.5An integer underflow in the DDS loader of Blender leads to an out-of-bounds read, possibly allowing an attacker to read sensitive data using CVE-2022-05457.8An integer overflow in the processing of loaded 2D images leads to a write-what-where vulnerability and an out-of-bounds read vulnerability,CVE-2022-05467.8A missing bounds check in the image loader used in Blender 3.x and 2.93.8 leads to out-of-bounds heap access, allowing an attacker to cause CVE-2022-05479.8OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes u CVE-2022-05496.5An issue has been discovered in GitLab CE/EE affecting all versions before 14.3.6, all versions starting from 14.4 before 14.4.4, all versio CVE-2022-05507.2Improper Input Validation vulnerability in custom report logo upload in Nozomi Networks Guardian, and CMC allows an authenticated attacker w CVE-2022-05517.2Improper Input Validation vulnerability in project file upload in Nozomi Networks Guardian and CMC allows an authenticated attacker with adm CVE-2022-05525.9A flaw was found in the original fix for the netty-codec-http CVE-2021-21409, where the OpenShift Logging openshift-logging/elasticsearch6-r CVE-2022-05534.6There is no check to see if slot 0 is being uploaded from the device to the host. When using encrypted images this means the unencrypted fir CVE-2022-05547.8Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.CVE-2022-05558.4Subiquity Shows Guided Storage Passphrase in Plaintext with Read-all Permissions CVE-2022-05567.8A local privilege escalation vulnerability caused by incorrect permission assignment in some directories of the Zyxel AP Configurator (ZAC)