CVE-2022-31144

moderate-risk
Published 2022-07-19

Redis is an in-memory database that persists on disk. A specially crafted `XAUTOCLAIM` command on a stream key in a specific state may result with heap overflow, and potentially remote code execution. This problem affects versions on the 7.x branch prior to 7.0.4. The patch is released in version 7.0.4.

Do I need to act?

!
21.2% chance of exploitation in next 30 days
EPSS score — higher than 79% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.0/10 High
LOCAL / HIGH complexity

Affected Products (1)

Affected Vendors

Redis

References (8)

Release Notes https://github.com/redis/redis/releases/tag/7.0.4
Third Party Advisory https://github.com/redis/redis/security/advisories/GHSA-96f7-42fg-2jrh
Third Party Advisory https://security.gentoo.org/glsa/202209-17
Third Party Advisory https://security.netapp.com/advisory/ntap-20220909-0002/
Release Notes https://github.com/redis/redis/releases/tag/7.0.4
Third Party Advisory https://github.com/redis/redis/security/advisories/GHSA-96f7-42fg-2jrh
Third Party Advisory https://security.gentoo.org/glsa/202209-17
Third Party Advisory https://security.netapp.com/advisory/ntap-20220909-0002/
37
/ 100
moderate-risk
Severity 18/34 · Moderate
Exploitability 14/34 · Moderate
Exposure 5/34 · Minimal