CVE-2020-14147

Katalog CVE

CVSS 7.7 · High EPSS 3,1%

Kerentanan Integer Overflow or Wraparound pada redislabs redis, oracle communications operations monitor +2 lainnya. Skor CVSS 3.1 7.7 (High) menurut NVD.

Deskripsi (NVD)

An integer overflow in the getnum function in lua_struct.c in Redis before 6.0.3 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow. NOTE: this issue exists because of a CVE-2015-8080 regression.

Rincian

Terbit di NVD

15 Juni 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.7 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-190: Integer Overflow or Wraparound
CWE-787: Out-of-bounds Write

EPSS (30 hari)

3,1% peluang dieksploitasi; lebih tinggi dari 87,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/antirez/redis/commit/ef764dde1cca2f25d00686673d1bc89448819571 patch · advisory pihak ketiga
• https://github.com/antirez/redis/pull/6875 patch · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00058.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202008-17 advisory pihak ketiga
• https://www.debian.org/security/2020/dsa-4731 advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujan2021.html advisory pihak ketiga