Published: 02/06/2021 Updated: 07/11/2023

CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 578

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer, could be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477. The problem is fixed in version 6.2.4 and 6.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the STRALGO LCS command. On 64 bit systems which have the fixes of CVE-2021-29477 (6.2.3 or 6.0.13), it is sufficient to make sure that the proto-max-bulk-len config parameter is smaller than 2GB (default is 512MB).

Vulnerable Product	Search on Vulmon	Subscribe to Product
redislabs redis
fedoraproject fedora 33
fedoraproject fedora 34

Debian Bug report logs - #989351 redis: CVE-2021-32625 Package: redis; Maintainer for redis is Chris Lamb <lamby@debianorg>; Source for redis is src:redis (PTS, buildd, popcon) Reported by: "Chris Lamb" <lamby@debianorg> Date: Tue, 1 Jun 2021 15:39:01 UTC Severity: grave Tags: security, upstream Found in version ...

Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker An integer overflow bug in Redis version 60 or newer could be exploited using the `STRALGO LCS` command to corrupt the heap and potentially result with remote code execution The problem is fixed in version 623 and 6013 An ad ...

Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker An integer overflow bug in Redis version 60 or newer (on 32-bit systems ONLY) can be exploited using the `STRALGO LCS` command to corrupt the heap and potentially result with remote code execution This is a result of an incomplet ...

An integer overflow bug in Redis versions 60 up to 623 can be exploited using the STRALGO LCS command to corrupt the heap and potentially result in remote code execution This is a result of an incomplete fix of CVE-2021-29477 ...

CWE-190 https://github.com/redis/redis/security/advisories/GHSA-46cp-x4x9-6pfq https://github.com/redis/redis/releases/tag/6.0.14 https://github.com/redis/redis/releases/tag/6.2.4 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BHWOF7CBVUGDK3AN6H3BN3VNTH2TDUZZ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SN7INTZFE34MIQJO7WDDTIY5LIBGN6GI/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989351 https://nvd.nist.gov https://alas.aws.amazon.com/AL2/ALASREDIS6-2023-008.html

CVE-2021-32625

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect