Vulnerability Details : CVE-2015-4335
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
Products affected by CVE-2015-4335
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:redislabs:redis:*:*:*:*:*:*:*:*
- cpe:2.3:a:redislabs:redis:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:redislabs:redis:3.0.1:*:*:*:*:*:*:*
Threat overview for CVE-2015-4335
Top countries where our scanners detected CVE-2015-4335
Top open port discovered on systems with this issue
6379
IPs affected by CVE-2015-4335 1,659
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2015-4335!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2015-4335
1.90%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 89 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-4335
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST |
CWE ids for CVE-2015-4335
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-4335
-
http://lists.opensuse.org/opensuse-updates/2015-10/msg00014.html
openSUSE-SU-2015:1687-1: moderate: Security update for redisThird Party Advisory
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162146.html
[SECURITY] Fedora 22 Update: redis-2.8.21-1.fc22Third Party Advisory
-
https://groups.google.com/forum/#!msg/redis-db/4Y6OqK8gEyk/Dg-5cejl-eUJ
[release] Redis 3.0.2 and Redis 2.8.21 are out - Google Groepen
-
http://www.openwall.com/lists/oss-security/2015/06/04/8
oss-security - CVE Request: redis Lua sandbox escape and arbitrary code executionMailing List;Third Party Advisory
-
http://www.openwall.com/lists/oss-security/2015/06/05/3
oss-security - Re: CVE Request: redis Lua sandbox escape and arbitrary code executionMailing List;Third Party Advisory
-
https://security.gentoo.org/glsa/201702-16
Redis: Multiple vulnerabilities (GLSA 201702-16) — Gentoo securityThird Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2015-1676.html
RHSA-2015:1676 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://benmmurphy.github.io/blog/2015/06/04/redis-eval-lua-sandbox-escape/
Redis EVAL Lua Sandbox Escape - Ben's BlogExploit;Third Party Advisory
-
http://www.debian.org/security/2015/dsa-3279
Debian -- Security Information -- DSA-3279-1 redisThird Party Advisory
-
https://github.com/antirez/redis/commit/fdf9d455098f54f7666c702ae464e6ea21e25411
disable loading lua bytecode · antirez/redis@fdf9d45 · GitHubThird Party Advisory
-
http://www.openwall.com/lists/oss-security/2015/06/04/12
oss-security - Re: CVE Request: redis Lua sandbox escape and arbitrary code executionMailing List;Third Party Advisory
-
http://www.securityfocus.com/bid/75034
Redis CVE-2015-4335 EVAL Lua Sandbox Security Bypass VulnerabilityThird Party Advisory;VDB Entry
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162094.html
[SECURITY] Fedora 21 Update: redis-2.8.21-1.fc21Third Party Advisory
Jump to