onyx --cves cve-2022-24736
CVE-2022-24736
- score
- <0.1
- cvss
- 3.3
- epss
- 1.5%
- published
- 2022-04-27
- kev added
- —
- first seen
Redis versions before 6.2.7 and 7.0.0 contain a NULL pointer dereference caused by loading a specially crafted Lua script, letting attackers cause a crash of the redis-server process, exploit requires sending malicious Lua scripts.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
- Public PoC
Exploit availability
Public PoC flagged by vulnx; no direct exploit link among the citations.
Weaknesses
References 10
- https://github.com/redis/redis/releases/tag/6.2.7
- https://github.com/redis/redis/security/advisories/GHSA-3qpw-7686-5984
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://github.com/redis/redis/pull/10651
- https://github.com/redis/redis/releases/tag/7.0.0
- https://security.gentoo.org/glsa/202209-17
- https://security.netapp.com/advisory/ntap-20220715-0003/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J4ZK3675DGHVVDOFLJN7WX6YYH27GPMK/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VPYKSG7LKUJGVM2P72EHXKVRVRWHLORX/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WSTPUCAPBRHIFPSCOURR4OYX4E2OISAF/