Published: 04/05/2021 Updated: 07/11/2023

CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 578

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer could be exploited using the `STRALGO LCS` command to corrupt the heap and potentially result with remote code execution. The problem is fixed in version 6.2.3 and 6.0.13. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the `STRALGO LCS` command.

Vulnerable Product	Search on Vulmon	Subscribe to Product
redislabs redis
fedoraproject fedora 33
fedoraproject fedora 34

Debian Bug report logs - #988045 redis: CVE-2021-29477 & CVE-2021-29478 Package: redis; Maintainer for redis is Chris Lamb <lamby@debianorg>; Source for redis is src:redis (PTS, buildd, popcon) Reported by: "Chris Lamb" <lamby@debianorg> Date: Tue, 4 May 2021 08:36:02 UTC Severity: grave Tags: security Found ...

Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker An integer overflow bug in Redis version 60 or newer could be exploited using the `STRALGO LCS` command to corrupt the heap and potentially result with remote code execution The problem is fixed in version 623 and 6013 An ad ...

An integer overflow bug in Redis version 60 or newer could be exploited using the STRALGO LCS command to corrupt the heap and potentially result in remote code execution The integer overflow bug exists in all versions of Redis starting with 60Integer overflow in COPY command for large intsets The issue is fixed in Redis version 623 ...

CWE-190 https://redis.io/https://github.com/redis/redis/security/advisories/GHSA-vqxj-26vj-996g https://security.gentoo.org/glsa/202107-20 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZJ6JGQ2ETZB2DWTQSGCOGG7EF3ILV4V/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPWBIZXA67JFIB63W2CNVVILCGIC2ME5/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BHWOF7CBVUGDK3AN6H3BN3VNTH2TDUZZ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SN7INTZFE34MIQJO7WDDTIY5LIBGN6GI/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=988045 https://nvd.nist.gov https://alas.aws.amazon.com/AL2/ALASREDIS6-2023-008.html

CVE-2021-29477

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect