CVE-2022-31144

Redis is an in-memory database that persists on disk. A specially crafted XAUTOCLAIM command on a stream key in a specific state may result with heap overflow, and potentially remote code execution. This problem affects versions on the 7.x branch prior to 7.0.4. The patch is released in version 7.0.4.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-122"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31144.json"
}

References

Affected packages

Git / github.com/redis/redis

Affected ranges

Type

GIT

Repo

https://github.com/redis/redis

Events

Introduced

d375595d5e3ae2e5c29e6c00a2dc3d60578fd9fc

Fixed

888effe4beb2c0ac8de1c863e635e45af3d3b329

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "7.0.0"
                },
                {
                    "fixed":  "7.0.4"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "original_tag":  "7.0.4",
            "range":  [
                {
                    "fixed":  "888effe4beb2c0ac8de1c863e635e45af3d3b329"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "cpe":  "cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "7.0"
                },
                {
                    "fixed":  "7.0.4"
                }
            ],
            "source":  "CPE_RANGE"
        }
    ]
}

Affected versions

7.*

7.0.0

7.0.1

7.0.2

7.0.3

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-31144.json"