Summary
Allows an authenticated user with permission to run Lua scripts (using EVAL or EVALSHA commands) to send a specially crafted Lua script. This script can manipulate the garbage collector to trigger the use-after-free condition, which can then be leveraged to escape the Lua sandbox and achieve arbitrary code execution on the underlying host system where Redis is running.
Products not listed in the Impact Details section have not been evaluated. Furthermore, products that have exceeded any software maintenance time periods are also not evaluated and will not be published. Please consult End of Sale and End of Service Life - Extreme Networks for the EOL notices related to the product under question.
Products Potentially Affected
None
Impact Details
|
OS/Product
|
Exposure
|
|
ExtremeCloud IQ Controller (IQC/XCC)
|
Yes
|
Repair Recommendations
ExtremeCloud IQ Controller (IQC/XCC):
- Fixed in 10.18.01 or later.
Please see the full Security Advisory here for more details and future updates.
