CVE-2022-36021: Redis string pattern matching can be abused to achieve Denial of Service
(CVE-2023-25155) Specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. https://github.com/gentoo/gentoo/pull/29860
Other sources
Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like SCAN or KEYS) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. The problem is fixed in Redis versions 6.0.18, 6.2.11, 7.0.9.
— Ubuntu
Redis is vulnerable to a denial of service, caused by a flaw in the string pattern matching functionality. By using the string matching commands (such as SCAN or KEYS) with a specially-crafted pattern, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-36021?
CVE-2022-36021 is a vulnerability in Redis that allows authenticated users to trigger a denial-of-service attack by using string matching commands with a specially crafted pattern.
How can this vulnerability be exploited?
This vulnerability can be exploited by authenticated users using string matching commands like `SCAN` or `KEYS` with a specific pattern.
What is the severity of CVE-2022-36021?
CVE-2022-36021 has a severity rating of medium.
How can I fix CVE-2022-36021?
To fix CVE-2022-36021, it is recommended to upgrade Redis to version 6.0.18 (for Redis 6.0) or versions between 6.2.0 and 6.2.11 (for Redis 6.2), or between 7.0.0 and 7.0.9 (for Redis 7.0).
What is the CWE ID for CVE-2022-36021?
The CWE ID for CVE-2022-36021 is CWE-407.