Published: 04/10/2021 Updated: 07/11/2023

CVSS v2 Base Score: 4 | Impact Score: 2.9 | Exploitability Score: 8

CVSS v3 Base Score: 4.3 | Impact Score: 1.4 | Exploitability Score: 2.8

VMScore: 356

Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N

Redis is an open source, in-memory database that persists on disk. When using the Redis Lua Debugger, users can send malformed requests that cause the debugger’s protocol parser to read data beyond the actual buffer. This issue affects all versions of Redis with Lua debugging support (3.2 or newer). The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14.

Vulnerable Product	Search on Vulmon	Subscribe to Product
redis redis
redhat enterprise linux 8.0
redhat software collections -
debian debian linux 10.0
debian debian linux 11.0
fedoraproject fedora 33
fedoraproject fedora 34
fedoraproject fedora 35
netapp management services for element software -
netapp management services for netapp hci -
oracle communications operations monitor 4.3
oracle communications operations monitor 4.4
oracle communications operations monitor 5.0

Multiple vulnerabilities were discovered in Redis, a persistent key-value database, which could result in denial of service or the execution of arbitrary code For the oldstable distribution (buster), these problems have been fixed in version 5:5014-1+deb10u1 For the stable distribution (bullseye), these problems have been fixed in version 5:60 ...

Redis is an open source, in-memory database that persists on disk In affected versions specially crafted Lua scripts executing in Redis can cause the heap-based Lua stack to be overflowed, due to incomplete checks for this condition This can result with heap corruption and potentially remote code execution This problem exists in all versions of ...

Redis is an open source, in-memory database that persists on disk When using the Redis Lua Debugger, users can send malformed requests that cause the debugger’s protocol parser to read data beyond the actual buffer This issue affects all versions of Redis with Lua debugging support (32 or newer) The problem is fixed in versions 626, 6016 ...

When using the Redis Lua Debugger, users can send malformed requests that cause the debugger’s protocol parser to read data beyond the actual buffer This issue affects all versions of Redis with Lua debugging support (32 or newer) The problem is fixed in versions 626, 6016 and 5014 ...

CWE-125 https://github.com/redis/redis/security/advisories/GHSA-9mj9-xx53-qmxm https://github.com/redis/redis/commit/6ac3c0b7abd35f37201ed2d6298ecef4ea1ae1dd https://security.netapp.com/advisory/ntap-20211104-0003/https://www.debian.org/security/2021/dsa-5001 https://www.oracle.com/security-alerts/cpuapr2022.html https://security.gentoo.org/glsa/202209-17 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/https://nvd.nist.gov https://www.debian.org/security/2021/dsa-5001

CVE-2021-32672

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect