An integer overflow in the getnum function in lua_struct.c in Redis before 6.0.3 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow. NOTE: this issue exists because of a CVE-2015-8080 regression.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - redis: integer overflow in the getnum function in lua_struct.c could lead to a DoS (CVE-2020-14147)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote host is affected by the vulnerability described in GLSA-202008-17 (Redis: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Redis. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

This update for redis fixes the following issues :

  - CVE-2020-14147: Context dependent attackers with     permission to run Lua code in a Redis session could have     caused a denial of service (memory corruption and     application crash) or possibly bypass sandbox     restrictions (boo#1173018)

An integer overflow flaw leading to a stack-based buffer overflow was discovered in redis, a persistent key-value database. A remote attacker can use this flaw to cause a denial of service (application crash).

An update of the redis package has been released.

ID	Name	Product	Family	Severity
199753	RHEL 8 : 5_redis (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
139936	GLSA-202008-17 : Redis: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
138978	openSUSE Security Update : redis (openSUSE-2020-1035)	Nessus	SuSE Local Security Checks	high
138651	Debian DSA-4731-1 : redis - security update	Nessus	Debian Local Security Checks	high
138192	Photon OS 2.0: Redis PHSA-2020-2.0-0256	Nessus	PhotonOS Local Security Checks	high
138183	Photon OS 3.0: Redis PHSA-2020-3.0-0108	Nessus	PhotonOS Local Security Checks	high
137878	Photon OS 1.0: Redis PHSA-2020-1.0-0304	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2020-14147

high

Tenable Plugins

high

critical

high

high

high

high

high