csaf_redhat - rhsa-2021

rhsa-2021_3945

Vulnerability from csaf_redhat

Published

2021-10-20 14:24

Modified

2024-11-15 11:57

Summary

Red Hat Security Advisory: redis:6 security update

Notes

Topic

An update for the redis:6 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log. Security Fix(es): * redis: Lua scripts can overflow the heap-based Lua stack (CVE-2021-32626) * redis: Integer overflow issue with Streams (CVE-2021-32627) * redis: Integer overflow bug in the ziplist data structure (CVE-2021-32628) * redis: Denial of service via Redis Standard Protocol (RESP) request (CVE-2021-32675) * redis: Integer overflow issue with intsets (CVE-2021-32687) * redis: Integer overflow issue with strings (CVE-2021-41099) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the redis:6 module is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.\n\nSecurity Fix(es):\n\n* redis: Lua scripts can overflow the heap-based Lua stack (CVE-2021-32626)\n\n* redis: Integer overflow issue with Streams (CVE-2021-32627)\n\n* redis: Integer overflow bug in the ziplist data structure (CVE-2021-32628)\n\n* redis: Denial of service via Redis Standard Protocol (RESP) request (CVE-2021-32675)\n\n* redis: Integer overflow issue with intsets (CVE-2021-32687)\n\n* redis: Integer overflow issue with strings (CVE-2021-41099)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2021:3945",
        "url": "https://access.redhat.com/errata/RHSA-2021:3945"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2010991",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2010991"
      },
      {
        "category": "external",
        "summary": "2011000",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2011000"
      },
      {
        "category": "external",
        "summary": "2011004",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2011004"
      },
      {
        "category": "external",
        "summary": "2011010",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2011010"
      },
      {
        "category": "external",
        "summary": "2011017",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2011017"
      },
      {
        "category": "external",
        "summary": "2011020",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2011020"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3945.json"
      }
    ],
    "title": "Red Hat Security Advisory: redis:6 security update",
    "tracking": {
      "current_release_date": "2024-11-15T11:57:39+00:00",
      "generator": {
        "date": "2024-11-15T11:57:39+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2021:3945",
      "initial_release_date": "2021-10-20T14:24:32+00:00",
      "revision_history": [
        {
          "date": "2021-10-20T14:24:32+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2021-10-20T14:24:32+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-15T11:57:39+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                  "product_id": "AppStream-8.4.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis:6:8040020211011082941:522a0ee4",
                "product": {
                  "name": "redis:6:8040020211011082941:522a0ee4",
                  "product_id": "redis:6:8040020211011082941:522a0ee4",
                  "product_identification_helper": {
                    "purl": "pkg:rpmmod/redhat/redis@6:8040020211011082941:522a0ee4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-doc-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.noarch",
                "product": {
                  "name": "redis-doc-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.noarch",
                  "product_id": "redis-doc-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-doc@6.0.9-5.module%2Bel8.4.0%2B12929%2B1bb0d2aa?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
                "product": {
                  "name": "redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
                  "product_id": "redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis@6.0.9-5.module%2Bel8.4.0%2B12929%2B1bb0d2aa?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
                "product": {
                  "name": "redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
                  "product_id": "redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debuginfo@6.0.9-5.module%2Bel8.4.0%2B12929%2B1bb0d2aa?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
                "product": {
                  "name": "redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
                  "product_id": "redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debugsource@6.0.9-5.module%2Bel8.4.0%2B12929%2B1bb0d2aa?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
                "product": {
                  "name": "redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
                  "product_id": "redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-devel@6.0.9-5.module%2Bel8.4.0%2B12929%2B1bb0d2aa?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.src",
                "product": {
                  "name": "redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.src",
                  "product_id": "redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis@6.0.9-5.module%2Bel8.4.0%2B12929%2B1bb0d2aa?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
                "product": {
                  "name": "redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
                  "product_id": "redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis@6.0.9-5.module%2Bel8.4.0%2B12929%2B1bb0d2aa?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
                "product": {
                  "name": "redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
                  "product_id": "redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debuginfo@6.0.9-5.module%2Bel8.4.0%2B12929%2B1bb0d2aa?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
                "product": {
                  "name": "redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
                  "product_id": "redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debugsource@6.0.9-5.module%2Bel8.4.0%2B12929%2B1bb0d2aa?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
                "product": {
                  "name": "redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
                  "product_id": "redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-devel@6.0.9-5.module%2Bel8.4.0%2B12929%2B1bb0d2aa?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
                "product": {
                  "name": "redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
                  "product_id": "redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis@6.0.9-5.module%2Bel8.4.0%2B12929%2B1bb0d2aa?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
                "product": {
                  "name": "redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
                  "product_id": "redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debuginfo@6.0.9-5.module%2Bel8.4.0%2B12929%2B1bb0d2aa?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
                "product": {
                  "name": "redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
                  "product_id": "redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debugsource@6.0.9-5.module%2Bel8.4.0%2B12929%2B1bb0d2aa?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
                "product": {
                  "name": "redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
                  "product_id": "redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-devel@6.0.9-5.module%2Bel8.4.0%2B12929%2B1bb0d2aa?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
                "product": {
                  "name": "redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
                  "product_id": "redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis@6.0.9-5.module%2Bel8.4.0%2B12929%2B1bb0d2aa?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
                "product": {
                  "name": "redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
                  "product_id": "redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debuginfo@6.0.9-5.module%2Bel8.4.0%2B12929%2B1bb0d2aa?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
                "product": {
                  "name": "redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
                  "product_id": "redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-debugsource@6.0.9-5.module%2Bel8.4.0%2B12929%2B1bb0d2aa?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
                "product": {
                  "name": "redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
                  "product_id": "redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redis-devel@6.0.9-5.module%2Bel8.4.0%2B12929%2B1bb0d2aa?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis:6:8040020211011082941:522a0ee4 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4"
        },
        "product_reference": "redis:6:8040020211011082941:522a0ee4",
        "relates_to_product_reference": "AppStream-8.4.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64 as a component of redis:6:8040020211011082941:522a0ee4 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64"
        },
        "product_reference": "redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
        "relates_to_product_reference": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le as a component of redis:6:8040020211011082941:522a0ee4 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le"
        },
        "product_reference": "redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
        "relates_to_product_reference": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x as a component of redis:6:8040020211011082941:522a0ee4 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x"
        },
        "product_reference": "redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
        "relates_to_product_reference": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.src as a component of redis:6:8040020211011082941:522a0ee4 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.src"
        },
        "product_reference": "redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.src",
        "relates_to_product_reference": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64 as a component of redis:6:8040020211011082941:522a0ee4 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64"
        },
        "product_reference": "redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
        "relates_to_product_reference": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64 as a component of redis:6:8040020211011082941:522a0ee4 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64"
        },
        "product_reference": "redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
        "relates_to_product_reference": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le as a component of redis:6:8040020211011082941:522a0ee4 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le"
        },
        "product_reference": "redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
        "relates_to_product_reference": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x as a component of redis:6:8040020211011082941:522a0ee4 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x"
        },
        "product_reference": "redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
        "relates_to_product_reference": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64 as a component of redis:6:8040020211011082941:522a0ee4 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64"
        },
        "product_reference": "redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
        "relates_to_product_reference": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64 as a component of redis:6:8040020211011082941:522a0ee4 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64"
        },
        "product_reference": "redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
        "relates_to_product_reference": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le as a component of redis:6:8040020211011082941:522a0ee4 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le"
        },
        "product_reference": "redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
        "relates_to_product_reference": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x as a component of redis:6:8040020211011082941:522a0ee4 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x"
        },
        "product_reference": "redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
        "relates_to_product_reference": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64 as a component of redis:6:8040020211011082941:522a0ee4 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64"
        },
        "product_reference": "redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
        "relates_to_product_reference": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64 as a component of redis:6:8040020211011082941:522a0ee4 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64"
        },
        "product_reference": "redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
        "relates_to_product_reference": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le as a component of redis:6:8040020211011082941:522a0ee4 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le"
        },
        "product_reference": "redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
        "relates_to_product_reference": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x as a component of redis:6:8040020211011082941:522a0ee4 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x"
        },
        "product_reference": "redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
        "relates_to_product_reference": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64 as a component of redis:6:8040020211011082941:522a0ee4 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64"
        },
        "product_reference": "redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
        "relates_to_product_reference": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redis-doc-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.noarch as a component of redis:6:8040020211011082941:522a0ee4 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-doc-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.noarch"
        },
        "product_reference": "redis-doc-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.noarch",
        "relates_to_product_reference": "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Meir Shpilraien"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2021-32626",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2021-10-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2011017"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A heap buffer overflow was found in redis. Specially crafted Lua scripts executing in Redis cause the heap-based Lua stack to overflow due to incomplete checks for this condition. This flaw allows a remote attacker to corrupt the heap and potentially trigger remote code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "redis: Lua scripts can overflow the heap-based Lua stack",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.src",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-doc-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-32626"
        },
        {
          "category": "external",
          "summary": "RHBZ#2011017",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2011017"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-32626",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-32626"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-32626",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32626"
        },
        {
          "category": "external",
          "summary": "https://github.com/redis/redis/security/advisories/GHSA-p486-xggp-782c",
          "url": "https://github.com/redis/redis/security/advisories/GHSA-p486-xggp-782c"
        }
      ],
      "release_date": "2021-10-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-10-20T14:24:32+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.src",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-doc-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:3945"
        },
        {
          "category": "workaround",
          "details": "Prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands. Please see https://redis.io/topics/acl for more information on how to do this.",
          "product_ids": [
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.src",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-doc-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.src",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-doc-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "redis: Lua scripts can overflow the heap-based Lua stack"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "sundb"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2021-32627",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2021-10-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2011010"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An integer overflow issue was found in redis. The vulnerability involves changing the default \"proto-max-bulk-len\" and \"client-query-buffer-limit\" configuration parameters to very large values and constructing specially crafted large stream elements. This flaw allows a remote attacker to corrupt the heap and potentially trigger remote code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "redis: Integer overflow issue with Streams",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.src",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-doc-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-32627"
        },
        {
          "category": "external",
          "summary": "RHBZ#2011010",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2011010"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-32627",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-32627"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-32627",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32627"
        },
        {
          "category": "external",
          "summary": "https://github.com/redis/redis/security/advisories/GHSA-f434-69fm-g45v",
          "url": "https://github.com/redis/redis/security/advisories/GHSA-f434-69fm-g45v"
        }
      ],
      "release_date": "2021-10-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-10-20T14:24:32+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.src",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-doc-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:3945"
        },
        {
          "category": "workaround",
          "details": "The flaw can be mitigated by disallowing usage of the CONFIG SET command via ACL configuration. This will prevent clients from setting the `proto-max-bulk-len` configuration parameter. Please see https://redis.io/topics/acl for more information on how to do this.",
          "product_ids": [
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.src",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-doc-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.src",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-doc-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "redis: Integer overflow issue with Streams"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "sundb"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2021-32628",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2021-10-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2011004"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An integer overflow issue was found in the redis ziplist data structure. The vulnerability involves modifying the default ziplist configuration parameters (hash-max-ziplist-entries, hash-max-ziplist-value, zset-max-ziplist-entries or zset-max-ziplist-value) to a very large value, and then constructing specially crafted commands to create very large ziplists. This flaw allows a remote attacker to corrupt the heap and potentially trigger remote code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "redis: Integer overflow bug in the ziplist data structure",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.src",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-doc-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-32628"
        },
        {
          "category": "external",
          "summary": "RHBZ#2011004",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2011004"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-32628",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-32628"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-32628",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32628"
        },
        {
          "category": "external",
          "summary": "https://github.com/redis/redis/security/advisories/GHSA-vw22-qm3h-49pr",
          "url": "https://github.com/redis/redis/security/advisories/GHSA-vw22-qm3h-49pr"
        }
      ],
      "release_date": "2021-10-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-10-20T14:24:32+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.src",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-doc-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:3945"
        },
        {
          "category": "workaround",
          "details": "The flaw can be mitigated by disallowing usage of the CONFIG SET command via ACL configuration. This will prevent clients from setting the above configuration parameters. Please see https://redis.io/topics/acl for more information on how to do this.",
          "product_ids": [
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.src",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-doc-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.src",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-doc-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "redis: Integer overflow bug in the ziplist data structure"
    },
    {
      "cve": "CVE-2021-32675",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2021-10-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2011000"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in redis. When parsing an incoming Redis Standard Protocol (RESP) request, redis allocates memory according to user-specified values, which determine the number of elements (in the multi-bulk header) and size of each element (in the bulk header). This flaw allows an unauthenticated, remote user delivering specially crafted requests over multiple connections to cause the server to allocate a significant amount of memory, resulting in a denial of service. The highest threat from this vulnerability is to system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "redis: Denial of service via Redis Standard Protocol (RESP) request",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.src",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-doc-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-32675"
        },
        {
          "category": "external",
          "summary": "RHBZ#2011000",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2011000"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-32675",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-32675"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-32675",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32675"
        },
        {
          "category": "external",
          "summary": "https://github.com/redis/redis/security/advisories/GHSA-f6pw-v9gw-v64p",
          "url": "https://github.com/redis/redis/security/advisories/GHSA-f6pw-v9gw-v64p"
        }
      ],
      "release_date": "2021-10-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-10-20T14:24:32+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.src",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-doc-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:3945"
        },
        {
          "category": "workaround",
          "details": "Prevent unauthenticated users from connecting to Redis by using network access control tools (e.g., firewalls) or enabling TLS and requiring users to authenticate using client side certificates.",
          "product_ids": [
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.src",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-doc-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.src",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-doc-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "redis: Denial of service via Redis Standard Protocol (RESP) request"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Pawel Wieczorkiewicz"
          ],
          "organization": "Amazon Web Services",
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2021-32687",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2021-10-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2010991"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An integer overflow issue was found in redis. The vulnerability involves changing the default \"set-max-intset-entries\" configuration parameter to a very large value and constructing specially crafted commands to manipulate sets. This flaw allows a remote attacker to leak arbitrary contents of the heap or potentially trigger remote code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "redis: Integer overflow issue with intsets",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.src",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-doc-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-32687"
        },
        {
          "category": "external",
          "summary": "RHBZ#2010991",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2010991"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-32687",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-32687"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-32687",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32687"
        },
        {
          "category": "external",
          "summary": "https://github.com/redis/redis/security/advisories/GHSA-m3mf-8x9w-r27q",
          "url": "https://github.com/redis/redis/security/advisories/GHSA-m3mf-8x9w-r27q"
        }
      ],
      "release_date": "2021-10-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-10-20T14:24:32+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.src",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-doc-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:3945"
        },
        {
          "category": "workaround",
          "details": "The flaw can be mitigated by disallowing usage of the CONFIG SET command via ACL configuration. This will prevent clients from setting the `set-max-intset-entries` configuration parameter. Please see https://redis.io/topics/acl for more information on how to do this.",
          "product_ids": [
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.src",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-doc-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.src",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-doc-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "redis: Integer overflow issue with intsets"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "yiyuaner"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2021-41099",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2021-10-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2011020"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An integer overflow issue was found in redis in the underlying string library. The vulnerability involves changing the default \"proto-max-bulk-len\" configuration parameter to a very large value and constructing specially crafted network payloads or commands. This flaw allows a remote attacker to corrupt the heap and potentially trigger remote code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "redis: Integer overflow issue with strings",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.src",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
          "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-doc-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-41099"
        },
        {
          "category": "external",
          "summary": "RHBZ#2011020",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2011020"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-41099",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-41099"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-41099",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41099"
        },
        {
          "category": "external",
          "summary": "https://github.com/redis/redis/security/advisories/GHSA-j3cr-9h5g-6cph",
          "url": "https://github.com/redis/redis/security/advisories/GHSA-j3cr-9h5g-6cph"
        }
      ],
      "release_date": "2021-10-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-10-20T14:24:32+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.src",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-doc-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:3945"
        },
        {
          "category": "workaround",
          "details": "The flaw can be mitigated by disallowing usage of the CONFIG SET command via ACL configuration. This will prevent clients from setting the `proto-max-bulk-len` configuration parameter. Please see https://redis.io/topics/acl for more information on how to do this.",
          "product_ids": [
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.src",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-doc-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.src",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64",
            "AppStream-8.4.0.Z.MAIN.EUS:redis:6:8040020211011082941:522a0ee4:redis-doc-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "redis: Integer overflow issue with strings"
    }
  ]
}

cve-2021-32626

Vulnerability from cvelistv5

Published

2021-10-04 17:30

Modified

2024-08-03 23:25

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can cause the heap-based Lua stack to be overflowed, due to incomplete checks for this condition. This can result with heap corruption and potentially remote code execution. This problem exists in all versions of Redis with Lua scripting support, starting from 2.6. The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14. For users unable to update an additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

References

▼	URL	Tags
	https://github.com/redis/redis/security/advisories/GHSA-p486-xggp-782c	x_refsource_CONFIRM
	https://github.com/redis/redis/commit/666ed7facf4524bf6d19b11b20faa2cf93fdf591	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/	vendor-advisory, x_refsource_FEDORA
	https://lists.apache.org/thread.html/r75490c61c2cb7b6ae2c81238fd52ae13636c60435abcd732d41531a0%40%3Ccommits.druid.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2021/dsa-5001	vendor-advisory, x_refsource_DEBIAN
	https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20211104-0003/	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/202209-17	vendor-advisory, x_refsource_GENTOO

Impacted products

Vendor

Product

Version

▼

redis

Version: >= 6.2.0, < 6.2.6
Version: >= 6.0.0, < 6.0.16
Version: >= 2.6.0, < 5.0.14

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T23:25:30.986Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/redis/redis/security/advisories/GHSA-p486-xggp-782c"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/redis/redis/commit/666ed7facf4524bf6d19b11b20faa2cf93fdf591"
          },
          {
            "name": "FEDORA-2021-8913c7900c",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/"
          },
          {
            "name": "FEDORA-2021-61c487f241",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/"
          },
          {
            "name": "[druid-commits] 20211025 [GitHub] [druid] jihoonson opened a new pull request #11844: Bump netty4 to 4.1.68; suppress CVE-2021-37136 and CVE-2021-37137 for netty3",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r75490c61c2cb7b6ae2c81238fd52ae13636c60435abcd732d41531a0%40%3Ccommits.druid.apache.org%3E"
          },
          {
            "name": "FEDORA-2021-aa94492a09",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/"
          },
          {
            "name": "DSA-5001",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-5001"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20211104-0003/"
          },
          {
            "name": "GLSA-202209-17",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-17"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "redis",
          "vendor": "redis",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6.2.0, \u003c 6.2.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.0.16"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.6.0, \u003c 5.0.14"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can cause the heap-based Lua stack to be overflowed, due to incomplete checks for this condition. This can result with heap corruption and potentially remote code execution. This problem exists in all versions of Redis with Lua scripting support, starting from 2.6. The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14. For users unable to update an additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122: Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787: Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-29T16:07:36",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/redis/redis/security/advisories/GHSA-p486-xggp-782c"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redis/redis/commit/666ed7facf4524bf6d19b11b20faa2cf93fdf591"
        },
        {
          "name": "FEDORA-2021-8913c7900c",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/"
        },
        {
          "name": "FEDORA-2021-61c487f241",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/"
        },
        {
          "name": "[druid-commits] 20211025 [GitHub] [druid] jihoonson opened a new pull request #11844: Bump netty4 to 4.1.68; suppress CVE-2021-37136 and CVE-2021-37137 for netty3",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r75490c61c2cb7b6ae2c81238fd52ae13636c60435abcd732d41531a0%40%3Ccommits.druid.apache.org%3E"
        },
        {
          "name": "FEDORA-2021-aa94492a09",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/"
        },
        {
          "name": "DSA-5001",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-5001"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20211104-0003/"
        },
        {
          "name": "GLSA-202209-17",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-17"
        }
      ],
      "source": {
        "advisory": "GHSA-p486-xggp-782c",
        "discovery": "UNKNOWN"
      },
      "title": "Lua scripts can overflow the heap-based Lua stack in Redis",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-32626",
          "STATE": "PUBLIC",
          "TITLE": "Lua scripts can overflow the heap-based Lua stack in Redis"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "redis",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003e= 6.2.0, \u003c 6.2.6"
                          },
                          {
                            "version_value": "\u003e= 6.0.0, \u003c 6.0.16"
                          },
                          {
                            "version_value": "\u003e= 2.6.0, \u003c 5.0.14"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "redis"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can cause the heap-based Lua stack to be overflowed, due to incomplete checks for this condition. This can result with heap corruption and potentially remote code execution. This problem exists in all versions of Redis with Lua scripting support, starting from 2.6. The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14. For users unable to update an additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-122: Heap-based Buffer Overflow"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-787: Out-of-bounds Write"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/redis/redis/security/advisories/GHSA-p486-xggp-782c",
              "refsource": "CONFIRM",
              "url": "https://github.com/redis/redis/security/advisories/GHSA-p486-xggp-782c"
            },
            {
              "name": "https://github.com/redis/redis/commit/666ed7facf4524bf6d19b11b20faa2cf93fdf591",
              "refsource": "MISC",
              "url": "https://github.com/redis/redis/commit/666ed7facf4524bf6d19b11b20faa2cf93fdf591"
            },
            {
              "name": "FEDORA-2021-8913c7900c",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/"
            },
            {
              "name": "FEDORA-2021-61c487f241",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/"
            },
            {
              "name": "[druid-commits] 20211025 [GitHub] [druid] jihoonson opened a new pull request #11844: Bump netty4 to 4.1.68; suppress CVE-2021-37136 and CVE-2021-37137 for netty3",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r75490c61c2cb7b6ae2c81238fd52ae13636c60435abcd732d41531a0@%3Ccommits.druid.apache.org%3E"
            },
            {
              "name": "FEDORA-2021-aa94492a09",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/"
            },
            {
              "name": "DSA-5001",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-5001"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20211104-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20211104-0003/"
            },
            {
              "name": "GLSA-202209-17",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-17"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-p486-xggp-782c",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-32626",
    "datePublished": "2021-10-04T17:30:11",
    "dateReserved": "2021-05-12T00:00:00",
    "dateUpdated": "2024-08-03T23:25:30.986Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2021-41099

Vulnerability from cvelistv5

Published

2021-10-04 18:05

Modified

2024-08-04 02:59

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the underlying string library can be used to corrupt the heap and potentially result with denial of service or remote code execution. The vulnerability involves changing the default proto-max-bulk-len configuration parameter to a very large value and constructing specially crafted network payloads or commands. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the proto-max-bulk-len configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.

References

▼	URL	Tags
	https://github.com/redis/redis/security/advisories/GHSA-j3cr-9h5g-6cph	x_refsource_CONFIRM
	https://github.com/redis/redis/commit/c6ad876774f3cc11e32681ea02a2eead00f2c521	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2021/dsa-5001	vendor-advisory, x_refsource_DEBIAN
	https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20211104-0003/	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/202209-17	vendor-advisory, x_refsource_GENTOO

Impacted products

Vendor

Product

Version

▼

redis

Version: < 5.0.14
Version: >= 6.0.0, < 6.0.16
Version: >= 6.2.0, 6.2.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T02:59:31.395Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/redis/redis/security/advisories/GHSA-j3cr-9h5g-6cph"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/redis/redis/commit/c6ad876774f3cc11e32681ea02a2eead00f2c521"
          },
          {
            "name": "FEDORA-2021-8913c7900c",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/"
          },
          {
            "name": "FEDORA-2021-61c487f241",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/"
          },
          {
            "name": "FEDORA-2021-aa94492a09",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/"
          },
          {
            "name": "DSA-5001",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-5001"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20211104-0003/"
          },
          {
            "name": "GLSA-202209-17",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-17"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "redis",
          "vendor": "redis",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.0.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.0.16"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.2.0, 6.2.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the underlying string library can be used to corrupt the heap and potentially result with denial of service or remote code execution. The vulnerability involves changing the default proto-max-bulk-len configuration parameter to a very large value and constructing specially crafted network payloads or commands. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the proto-max-bulk-len configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-680",
              "description": "CWE-680: Integer Overflow to Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-29T16:07:43",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/redis/redis/security/advisories/GHSA-j3cr-9h5g-6cph"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redis/redis/commit/c6ad876774f3cc11e32681ea02a2eead00f2c521"
        },
        {
          "name": "FEDORA-2021-8913c7900c",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/"
        },
        {
          "name": "FEDORA-2021-61c487f241",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/"
        },
        {
          "name": "FEDORA-2021-aa94492a09",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/"
        },
        {
          "name": "DSA-5001",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-5001"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20211104-0003/"
        },
        {
          "name": "GLSA-202209-17",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-17"
        }
      ],
      "source": {
        "advisory": "GHSA-j3cr-9h5g-6cph",
        "discovery": "UNKNOWN"
      },
      "title": "Integer overflow issue with strings in Redis",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-41099",
          "STATE": "PUBLIC",
          "TITLE": "Integer overflow issue with strings in Redis"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "redis",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 5.0.14"
                          },
                          {
                            "version_value": "\u003e= 6.0.0, \u003c 6.0.16"
                          },
                          {
                            "version_value": "\u003e= 6.2.0, 6.2.6"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "redis"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the underlying string library can be used to corrupt the heap and potentially result with denial of service or remote code execution. The vulnerability involves changing the default proto-max-bulk-len configuration parameter to a very large value and constructing specially crafted network payloads or commands. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the proto-max-bulk-len configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-190: Integer Overflow or Wraparound"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-680: Integer Overflow to Buffer Overflow"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/redis/redis/security/advisories/GHSA-j3cr-9h5g-6cph",
              "refsource": "CONFIRM",
              "url": "https://github.com/redis/redis/security/advisories/GHSA-j3cr-9h5g-6cph"
            },
            {
              "name": "https://github.com/redis/redis/commit/c6ad876774f3cc11e32681ea02a2eead00f2c521",
              "refsource": "MISC",
              "url": "https://github.com/redis/redis/commit/c6ad876774f3cc11e32681ea02a2eead00f2c521"
            },
            {
              "name": "FEDORA-2021-8913c7900c",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/"
            },
            {
              "name": "FEDORA-2021-61c487f241",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/"
            },
            {
              "name": "FEDORA-2021-aa94492a09",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/"
            },
            {
              "name": "DSA-5001",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-5001"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20211104-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20211104-0003/"
            },
            {
              "name": "GLSA-202209-17",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-17"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-j3cr-9h5g-6cph",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-41099",
    "datePublished": "2021-10-04T18:05:11",
    "dateReserved": "2021-09-15T00:00:00",
    "dateUpdated": "2024-08-04T02:59:31.395Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2021-32675

Vulnerability from cvelistv5

Published

2021-10-04 17:50

Modified

2024-08-03 23:25

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

Redis is an open source, in-memory database that persists on disk. When parsing an incoming Redis Standard Protocol (RESP) request, Redis allocates memory according to user-specified values which determine the number of elements (in the multi-bulk header) and size of each element (in the bulk header). An attacker delivering specially crafted requests over multiple connections can cause the server to allocate significant amount of memory. Because the same parsing mechanism is used to handle authentication requests, this vulnerability can also be exploited by unauthenticated users. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. An additional workaround to mitigate this problem without patching the redis-server executable is to block access to prevent unauthenticated users from connecting to Redis. This can be done in different ways: Using network access control tools like firewalls, iptables, security groups, etc. or Enabling TLS and requiring users to authenticate using client side certificates.

References

▼	URL	Tags
	https://github.com/redis/redis/security/advisories/GHSA-f6pw-v9gw-v64p	x_refsource_CONFIRM
	https://github.com/redis/redis/commit/5674b0057ff2903d43eaff802017eddf37c360f8	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/	vendor-advisory, x_refsource_FEDORA
	https://lists.apache.org/thread.html/ra603ff6e04549d7f290f61f9b11e2d2e4dba693b05ff053f4ec6bc47%40%3Cnotifications.geode.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2021/dsa-5001	vendor-advisory, x_refsource_DEBIAN
	https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20211104-0003/	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/202209-17	vendor-advisory, x_refsource_GENTOO

Impacted products

Vendor

Product

Version

▼

redis

Version: < 5.0.14
Version: >= 6.0.0, < 6.0.16
Version: >= 6.2.0, < 6.2.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T23:25:31.170Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/redis/redis/security/advisories/GHSA-f6pw-v9gw-v64p"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/redis/redis/commit/5674b0057ff2903d43eaff802017eddf37c360f8"
          },
          {
            "name": "FEDORA-2021-8913c7900c",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/"
          },
          {
            "name": "FEDORA-2021-61c487f241",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/"
          },
          {
            "name": "[geode-notifications] 20211013 [GitHub] [geode] jdeppe-pivotal opened a new pull request #6994: GEODE-9676: Limit array and string sizes for unauthenticated Radish connections",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/ra603ff6e04549d7f290f61f9b11e2d2e4dba693b05ff053f4ec6bc47%40%3Cnotifications.geode.apache.org%3E"
          },
          {
            "name": "FEDORA-2021-aa94492a09",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/"
          },
          {
            "name": "DSA-5001",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-5001"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20211104-0003/"
          },
          {
            "name": "GLSA-202209-17",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-17"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "redis",
          "vendor": "redis",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.0.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.0.16"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.2.0, \u003c 6.2.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Redis is an open source, in-memory database that persists on disk. When parsing an incoming Redis Standard Protocol (RESP) request, Redis allocates memory according to user-specified values which determine the number of elements (in the multi-bulk header) and size of each element (in the bulk header). An attacker delivering specially crafted requests over multiple connections can cause the server to allocate significant amount of memory. Because the same parsing mechanism is used to handle authentication requests, this vulnerability can also be exploited by unauthenticated users. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. An additional workaround to mitigate this problem without patching the redis-server executable is to block access to prevent unauthenticated users from connecting to Redis. This can be done in different ways: Using network access control tools like firewalls, iptables, security groups, etc. or Enabling TLS and requiring users to authenticate using client side certificates."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-29T16:07:35",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/redis/redis/security/advisories/GHSA-f6pw-v9gw-v64p"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redis/redis/commit/5674b0057ff2903d43eaff802017eddf37c360f8"
        },
        {
          "name": "FEDORA-2021-8913c7900c",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/"
        },
        {
          "name": "FEDORA-2021-61c487f241",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/"
        },
        {
          "name": "[geode-notifications] 20211013 [GitHub] [geode] jdeppe-pivotal opened a new pull request #6994: GEODE-9676: Limit array and string sizes for unauthenticated Radish connections",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/ra603ff6e04549d7f290f61f9b11e2d2e4dba693b05ff053f4ec6bc47%40%3Cnotifications.geode.apache.org%3E"
        },
        {
          "name": "FEDORA-2021-aa94492a09",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/"
        },
        {
          "name": "DSA-5001",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-5001"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20211104-0003/"
        },
        {
          "name": "GLSA-202209-17",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-17"
        }
      ],
      "source": {
        "advisory": "GHSA-f6pw-v9gw-v64p",
        "discovery": "UNKNOWN"
      },
      "title": "DoS vulnerability in Redis",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-32675",
          "STATE": "PUBLIC",
          "TITLE": "DoS vulnerability in Redis"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "redis",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 5.0.14"
                          },
                          {
                            "version_value": "\u003e= 6.0.0, \u003c 6.0.16"
                          },
                          {
                            "version_value": "\u003e= 6.2.0, \u003c 6.2.6"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "redis"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Redis is an open source, in-memory database that persists on disk. When parsing an incoming Redis Standard Protocol (RESP) request, Redis allocates memory according to user-specified values which determine the number of elements (in the multi-bulk header) and size of each element (in the bulk header). An attacker delivering specially crafted requests over multiple connections can cause the server to allocate significant amount of memory. Because the same parsing mechanism is used to handle authentication requests, this vulnerability can also be exploited by unauthenticated users. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. An additional workaround to mitigate this problem without patching the redis-server executable is to block access to prevent unauthenticated users from connecting to Redis. This can be done in different ways: Using network access control tools like firewalls, iptables, security groups, etc. or Enabling TLS and requiring users to authenticate using client side certificates."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-770: Allocation of Resources Without Limits or Throttling"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/redis/redis/security/advisories/GHSA-f6pw-v9gw-v64p",
              "refsource": "CONFIRM",
              "url": "https://github.com/redis/redis/security/advisories/GHSA-f6pw-v9gw-v64p"
            },
            {
              "name": "https://github.com/redis/redis/commit/5674b0057ff2903d43eaff802017eddf37c360f8",
              "refsource": "MISC",
              "url": "https://github.com/redis/redis/commit/5674b0057ff2903d43eaff802017eddf37c360f8"
            },
            {
              "name": "FEDORA-2021-8913c7900c",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/"
            },
            {
              "name": "FEDORA-2021-61c487f241",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/"
            },
            {
              "name": "[geode-notifications] 20211013 [GitHub] [geode] jdeppe-pivotal opened a new pull request #6994: GEODE-9676: Limit array and string sizes for unauthenticated Radish connections",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/ra603ff6e04549d7f290f61f9b11e2d2e4dba693b05ff053f4ec6bc47@%3Cnotifications.geode.apache.org%3E"
            },
            {
              "name": "FEDORA-2021-aa94492a09",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/"
            },
            {
              "name": "DSA-5001",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-5001"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20211104-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20211104-0003/"
            },
            {
              "name": "GLSA-202209-17",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-17"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-f6pw-v9gw-v64p",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-32675",
    "datePublished": "2021-10-04T17:50:11",
    "dateReserved": "2021-05-12T00:00:00",
    "dateUpdated": "2024-08-03T23:25:31.170Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2021-32627

Vulnerability from cvelistv5

Published

2021-10-04 17:35

Modified

2024-08-03 23:25

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

Redis is an open source, in-memory database that persists on disk. In affected versions an integer overflow bug in Redis can be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves changing the default proto-max-bulk-len and client-query-buffer-limit configuration parameters to very large values and constructing specially crafted very large stream elements. The problem is fixed in Redis 6.2.6, 6.0.16 and 5.0.14. For users unable to upgrade an additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the proto-max-bulk-len configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.

References

▼	URL	Tags
	https://github.com/redis/redis/commit/f6a40570fa63d5afdd596c78083d754081d80ae3	x_refsource_MISC
	https://github.com/redis/redis/security/advisories/GHSA-f434-69fm-g45v	x_refsource_CONFIRM
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2021/dsa-5001	vendor-advisory, x_refsource_DEBIAN
	https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20211104-0003/	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/202209-17	vendor-advisory, x_refsource_GENTOO

Impacted products

Vendor

Product

Version

▼

redis

Version: >= 5.0.0, < 5.0.14
Version: >= 6.0.0, < 6.0.16
Version: >= 6.2.0, < 6.2.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T23:25:30.868Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/redis/redis/commit/f6a40570fa63d5afdd596c78083d754081d80ae3"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/redis/redis/security/advisories/GHSA-f434-69fm-g45v"
          },
          {
            "name": "FEDORA-2021-8913c7900c",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/"
          },
          {
            "name": "FEDORA-2021-61c487f241",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/"
          },
          {
            "name": "FEDORA-2021-aa94492a09",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/"
          },
          {
            "name": "DSA-5001",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-5001"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20211104-0003/"
          },
          {
            "name": "GLSA-202209-17",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-17"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "redis",
          "vendor": "redis",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.0.0, \u003c 5.0.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.0.16"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.2.0, \u003c 6.2.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Redis is an open source, in-memory database that persists on disk. In affected versions an integer overflow bug in Redis can be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves changing the default proto-max-bulk-len and client-query-buffer-limit configuration parameters to very large values and constructing specially crafted very large stream elements. The problem is fixed in Redis 6.2.6, 6.0.16 and 5.0.14. For users unable to upgrade an additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the proto-max-bulk-len configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-680",
              "description": "CWE-680: Integer Overflow to Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-29T16:07:28",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redis/redis/commit/f6a40570fa63d5afdd596c78083d754081d80ae3"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/redis/redis/security/advisories/GHSA-f434-69fm-g45v"
        },
        {
          "name": "FEDORA-2021-8913c7900c",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/"
        },
        {
          "name": "FEDORA-2021-61c487f241",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/"
        },
        {
          "name": "FEDORA-2021-aa94492a09",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/"
        },
        {
          "name": "DSA-5001",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-5001"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20211104-0003/"
        },
        {
          "name": "GLSA-202209-17",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-17"
        }
      ],
      "source": {
        "advisory": "GHSA-f434-69fm-g45v",
        "discovery": "UNKNOWN"
      },
      "title": "Integer overflow issue with Streams in Redis",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-32627",
          "STATE": "PUBLIC",
          "TITLE": "Integer overflow issue with Streams in Redis"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "redis",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003e= 5.0.0, \u003c 5.0.14"
                          },
                          {
                            "version_value": "\u003e= 6.0.0, \u003c 6.0.16"
                          },
                          {
                            "version_value": "\u003e= 6.2.0, \u003c 6.2.6"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "redis"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Redis is an open source, in-memory database that persists on disk. In affected versions an integer overflow bug in Redis can be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves changing the default proto-max-bulk-len and client-query-buffer-limit configuration parameters to very large values and constructing specially crafted very large stream elements. The problem is fixed in Redis 6.2.6, 6.0.16 and 5.0.14. For users unable to upgrade an additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the proto-max-bulk-len configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-190: Integer Overflow or Wraparound"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-680: Integer Overflow to Buffer Overflow"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/redis/redis/commit/f6a40570fa63d5afdd596c78083d754081d80ae3",
              "refsource": "MISC",
              "url": "https://github.com/redis/redis/commit/f6a40570fa63d5afdd596c78083d754081d80ae3"
            },
            {
              "name": "https://github.com/redis/redis/security/advisories/GHSA-f434-69fm-g45v",
              "refsource": "CONFIRM",
              "url": "https://github.com/redis/redis/security/advisories/GHSA-f434-69fm-g45v"
            },
            {
              "name": "FEDORA-2021-8913c7900c",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/"
            },
            {
              "name": "FEDORA-2021-61c487f241",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/"
            },
            {
              "name": "FEDORA-2021-aa94492a09",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/"
            },
            {
              "name": "DSA-5001",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-5001"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20211104-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20211104-0003/"
            },
            {
              "name": "GLSA-202209-17",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-17"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-f434-69fm-g45v",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-32627",
    "datePublished": "2021-10-04T17:35:16",
    "dateReserved": "2021-05-12T00:00:00",
    "dateUpdated": "2024-08-03T23:25:30.868Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2021-32628

Vulnerability from cvelistv5

Published

2021-10-04 17:35

Modified

2024-08-03 23:25

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the ziplist data structure used by all versions of Redis can be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves modifying the default ziplist configuration parameters (hash-max-ziplist-entries, hash-max-ziplist-value, zset-max-ziplist-entries or zset-max-ziplist-value) to a very large value, and then constructing specially crafted commands to create very large ziplists. The problem is fixed in Redis versions 6.2.6, 6.0.16, 5.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the above configuration parameters. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.

References

▼	URL	Tags
	https://github.com/redis/redis/security/advisories/GHSA-vw22-qm3h-49pr	x_refsource_CONFIRM
	https://github.com/redis/redis/commit/f6a40570fa63d5afdd596c78083d754081d80ae3	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2021/dsa-5001	vendor-advisory, x_refsource_DEBIAN
	https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20211104-0003/	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/202209-17	vendor-advisory, x_refsource_GENTOO

Impacted products

Vendor

Product

Version

▼

redis

Version: >= 6.2.0, < 6.2.6
Version: >= 6.0.0, < 6.0.16
Version: < 5.0.14

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T23:25:30.918Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/redis/redis/security/advisories/GHSA-vw22-qm3h-49pr"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/redis/redis/commit/f6a40570fa63d5afdd596c78083d754081d80ae3"
          },
          {
            "name": "FEDORA-2021-8913c7900c",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/"
          },
          {
            "name": "FEDORA-2021-61c487f241",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/"
          },
          {
            "name": "FEDORA-2021-aa94492a09",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/"
          },
          {
            "name": "DSA-5001",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-5001"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20211104-0003/"
          },
          {
            "name": "GLSA-202209-17",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-17"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "redis",
          "vendor": "redis",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6.2.0, \u003c 6.2.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.0.16"
            },
            {
              "status": "affected",
              "version": "\u003c 5.0.14"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the ziplist data structure used by all versions of Redis can be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves modifying the default ziplist configuration parameters (hash-max-ziplist-entries, hash-max-ziplist-value, zset-max-ziplist-entries or zset-max-ziplist-value) to a very large value, and then constructing specially crafted commands to create very large ziplists. The problem is fixed in Redis versions 6.2.6, 6.0.16, 5.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the above configuration parameters. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-680",
              "description": "CWE-680: Integer Overflow to Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-29T16:07:46",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/redis/redis/security/advisories/GHSA-vw22-qm3h-49pr"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redis/redis/commit/f6a40570fa63d5afdd596c78083d754081d80ae3"
        },
        {
          "name": "FEDORA-2021-8913c7900c",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/"
        },
        {
          "name": "FEDORA-2021-61c487f241",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/"
        },
        {
          "name": "FEDORA-2021-aa94492a09",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/"
        },
        {
          "name": "DSA-5001",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-5001"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20211104-0003/"
        },
        {
          "name": "GLSA-202209-17",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-17"
        }
      ],
      "source": {
        "advisory": "GHSA-vw22-qm3h-49pr",
        "discovery": "UNKNOWN"
      },
      "title": "Vulnerability in handling large ziplists",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-32628",
          "STATE": "PUBLIC",
          "TITLE": "Vulnerability in handling large ziplists"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "redis",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003e= 6.2.0, \u003c 6.2.6"
                          },
                          {
                            "version_value": "\u003e= 6.0.0, \u003c 6.0.16"
                          },
                          {
                            "version_value": "\u003c 5.0.14"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "redis"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the ziplist data structure used by all versions of Redis can be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves modifying the default ziplist configuration parameters (hash-max-ziplist-entries, hash-max-ziplist-value, zset-max-ziplist-entries or zset-max-ziplist-value) to a very large value, and then constructing specially crafted commands to create very large ziplists. The problem is fixed in Redis versions 6.2.6, 6.0.16, 5.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the above configuration parameters. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-190: Integer Overflow or Wraparound"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-680: Integer Overflow to Buffer Overflow"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/redis/redis/security/advisories/GHSA-vw22-qm3h-49pr",
              "refsource": "CONFIRM",
              "url": "https://github.com/redis/redis/security/advisories/GHSA-vw22-qm3h-49pr"
            },
            {
              "name": "https://github.com/redis/redis/commit/f6a40570fa63d5afdd596c78083d754081d80ae3",
              "refsource": "MISC",
              "url": "https://github.com/redis/redis/commit/f6a40570fa63d5afdd596c78083d754081d80ae3"
            },
            {
              "name": "FEDORA-2021-8913c7900c",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/"
            },
            {
              "name": "FEDORA-2021-61c487f241",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/"
            },
            {
              "name": "FEDORA-2021-aa94492a09",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/"
            },
            {
              "name": "DSA-5001",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-5001"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20211104-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20211104-0003/"
            },
            {
              "name": "GLSA-202209-17",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-17"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-vw22-qm3h-49pr",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-32628",
    "datePublished": "2021-10-04T17:35:11",
    "dateReserved": "2021-05-12T00:00:00",
    "dateUpdated": "2024-08-03T23:25:30.918Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2021-32687

Vulnerability from cvelistv5

Published

2021-10-04 17:55

Modified

2024-08-03 23:25

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

Redis is an open source, in-memory database that persists on disk. An integer overflow bug affecting all versions of Redis can be exploited to corrupt the heap and potentially be used to leak arbitrary contents of the heap or trigger remote code execution. The vulnerability involves changing the default set-max-intset-entries configuration parameter to a very large value and constructing specially crafted commands to manipulate sets. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the set-max-intset-entries configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.

References

▼	URL	Tags
	https://github.com/redis/redis/security/advisories/GHSA-m3mf-8x9w-r27q	x_refsource_CONFIRM
	https://github.com/redis/redis/commit/a30d367a71b7017581cf1ca104242a3c644dec0f	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2021/dsa-5001	vendor-advisory, x_refsource_DEBIAN
	https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20211104-0003/	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/202209-17	vendor-advisory, x_refsource_GENTOO

Impacted products

Vendor

Product

Version

▼

redis

Version: < 5.0.14
Version: >= 6.0.0, < 6.0.16
Version: >= 6.2.0, < 6.2.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T23:25:31.090Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/redis/redis/security/advisories/GHSA-m3mf-8x9w-r27q"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/redis/redis/commit/a30d367a71b7017581cf1ca104242a3c644dec0f"
          },
          {
            "name": "FEDORA-2021-8913c7900c",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/"
          },
          {
            "name": "FEDORA-2021-61c487f241",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/"
          },
          {
            "name": "FEDORA-2021-aa94492a09",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/"
          },
          {
            "name": "DSA-5001",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-5001"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20211104-0003/"
          },
          {
            "name": "GLSA-202209-17",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-17"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "redis",
          "vendor": "redis",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.0.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.0.16"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.2.0, \u003c 6.2.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Redis is an open source, in-memory database that persists on disk. An integer overflow bug affecting all versions of Redis can be exploited to corrupt the heap and potentially be used to leak arbitrary contents of the heap or trigger remote code execution. The vulnerability involves changing the default set-max-intset-entries configuration parameter to a very large value and constructing specially crafted commands to manipulate sets. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the set-max-intset-entries configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-680",
              "description": "CWE-680: Integer Overflow to Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-29T16:07:44",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/redis/redis/security/advisories/GHSA-m3mf-8x9w-r27q"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redis/redis/commit/a30d367a71b7017581cf1ca104242a3c644dec0f"
        },
        {
          "name": "FEDORA-2021-8913c7900c",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/"
        },
        {
          "name": "FEDORA-2021-61c487f241",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/"
        },
        {
          "name": "FEDORA-2021-aa94492a09",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/"
        },
        {
          "name": "DSA-5001",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-5001"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20211104-0003/"
        },
        {
          "name": "GLSA-202209-17",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-17"
        }
      ],
      "source": {
        "advisory": "GHSA-m3mf-8x9w-r27q",
        "discovery": "UNKNOWN"
      },
      "title": "Integer overflow issue with intsets in Redis",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-32687",
          "STATE": "PUBLIC",
          "TITLE": "Integer overflow issue with intsets in Redis"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "redis",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 5.0.14"
                          },
                          {
                            "version_value": "\u003e= 6.0.0, \u003c 6.0.16"
                          },
                          {
                            "version_value": "\u003e= 6.2.0, \u003c 6.2.6"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "redis"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Redis is an open source, in-memory database that persists on disk. An integer overflow bug affecting all versions of Redis can be exploited to corrupt the heap and potentially be used to leak arbitrary contents of the heap or trigger remote code execution. The vulnerability involves changing the default set-max-intset-entries configuration parameter to a very large value and constructing specially crafted commands to manipulate sets. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the set-max-intset-entries configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-190: Integer Overflow or Wraparound"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-680: Integer Overflow to Buffer Overflow"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/redis/redis/security/advisories/GHSA-m3mf-8x9w-r27q",
              "refsource": "CONFIRM",
              "url": "https://github.com/redis/redis/security/advisories/GHSA-m3mf-8x9w-r27q"
            },
            {
              "name": "https://github.com/redis/redis/commit/a30d367a71b7017581cf1ca104242a3c644dec0f",
              "refsource": "MISC",
              "url": "https://github.com/redis/redis/commit/a30d367a71b7017581cf1ca104242a3c644dec0f"
            },
            {
              "name": "FEDORA-2021-8913c7900c",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/"
            },
            {
              "name": "FEDORA-2021-61c487f241",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/"
            },
            {
              "name": "FEDORA-2021-aa94492a09",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/"
            },
            {
              "name": "DSA-5001",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-5001"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20211104-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20211104-0003/"
            },
            {
              "name": "GLSA-202209-17",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-17"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-m3mf-8x9w-r27q",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-32687",
    "datePublished": "2021-10-04T17:55:10",
    "dateReserved": "2021-05-12T00:00:00",
    "dateUpdated": "2024-08-03T23:25:31.090Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

rhsa-2021_3945

Vulnerability from csaf_redhat

cve-2021-32626

Vulnerability from cvelistv5

cve-2021-41099

Vulnerability from cvelistv5

cve-2021-32675

Vulnerability from cvelistv5

cve-2021-32627

Vulnerability from cvelistv5

cve-2021-32628

Vulnerability from cvelistv5

cve-2021-32687

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature