3 ms·
Basically guaranteed RCE for vulnerable configurations - a severity of 10 seems apt. The aspect that it's only impacting a small percentage of installations in
by baobun 1y ago
Basically guaranteed RCE for vulnerable configurations - a severity of 10 seems apt.
The aspect that it's only impacting a small percentage of installations in practice does not factor into the severity calculation.
OTOH I'd question the "Privileges required: low" part of the CVSS table. While out-of-box redis is vulnerable, typical deployments are secured by at least a password. Exploitation would need authentication or a separate auth bypass.
Most in-house redis deployments are probably safu if deployed according to best practices but Redis-as-a-service operators want to be on top of this.
- tptacek 1y agoLook, I'm not trying to tell you it's not a severe vulnerability. I'm telling you that it is not of a caliber to rank among the most severe vulnerabilities ever discovered, which is what a CVSS score of 10 means. Shellshock, which did not get scored as a "10", is in the top tier of vulnerabilities, far more severe than this one by all appearances, and it too doesn't deserve a 10. The point isn't anything to do with the vulnerability. It's this stupid scale.