CVE-2020-14147

An integer overflow in the getnum function in lua_struct.c in Redis before 6.0.3 allows context-dependent attackers with permission to run Lua code in a Redis…

published June 15, 2020

CVSS
—
EPSS
3%
Percentile
87.6
In the wild
Unconfirmed
What it is

An integer overflow in the getnum function in lua_struct.c in Redis before 6.0.3 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow. NOTE: this issue exists because of a CVE-2015-8080 regression.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03085 · 87.6th percentile
Published
2020-06-15T16:52Z
EPSS history
Timeline
  • 15 JUN 16:52Z
    An integer overflow in the getnum function in lua_struct.c in Redis before 6.0.3 allows context-dependent attackers with permission to run Lua code in a Redis…
    cvelistv5