CVE-2020-14147

Name of the Vulnerable Software and Affected Versions Redis versions prior to 6.0.3

Description The issue is caused by an integer overflow in the getnum function, which allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service or possibly bypass intended sandbox restrictions. This can be achieved by providing a large number that triggers a stack-based buffer overflow. The issue exists due to a regression of a previously known problem.

Recommendations For versions prior to 6.0.3, update to version 6.0.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of Lua code in Redis sessions to minimize the risk of exploitation.