CVE-2022-0543

Redis ships an embedded Lua interpreter meant to run inside a sandbox, so scripts sent to the server can't touch the underlying system. On Debian and Ubuntu, a packaging quirk left the Lua library incompletely sandboxed: the `package` module was reachable from within a script, and from there an attacker can load arbitrary native code and break out of the interpreter entirely. Any client that can reach the Redis port and run `EVAL` can turn a data-store command into remote code execution as the Redis user. No authentication is required on the many Redis instances left open by default.

The exposure is large because Redis is rarely internet-facing by intent yet frequently ends up that way, bound to all interfaces with no password behind a misconfigured firewall or container network. This bug became a staple of opportunistic botnet and cryptomining campaigns precisely because it is trivial to script against a huge population of unauthenticated instances. It only affects the distro-packaged builds, so the fix is to update the OS package rather than chase upstream Redis versions. Beyond patching, get Redis off the public internet, require authentication, and treat any previously exposed instance as potentially compromised.