CVE-2020-14147 vulnerability in Redis Labs and Other Products
Published on June 15, 2020
An integer overflow in the getnum function in lua_struct.c in Redis before 6.0.3 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow. NOTE: this issue exists because of a CVE-2015-8080 regression.
Products Associated with CVE-2020-14147
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2020-14147 are published in these products:
Exploit Probability
EPSS
0.27%
Percentile
50.25%
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.