rhsa-2021_3949
Vulnerability from csaf_redhat
Published
2021-10-20 19:44
Modified
2024-11-22 17:22
Summary
Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.1.12 security fixes and container updates

Notes

Topic
Red Hat Advanced Cluster Management for Kubernetes 2.1.12 General Availability release images, which provide security fixes and update the container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat Advanced Cluster Management for Kubernetes 2.1.12 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains updates to one or more container images for Red Hat Advanced Cluster Management for Kubernetes. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.1/html/release_notes/ Security fixes: * redis: Lua scripts can overflow the heap-based Lua stack (CVE-2021-32626) * redis: Integer overflow issue with Streams (CVE-2021-32627) * redis: Integer overflow bug in the ziplist data structure (CVE-2021-32628) * redis: Integer overflow issue with intsets (CVE-2021-32687) * redis: Integer overflow issue with strings (CVE-2021-41099) * redis: Denial of service via Redis Standard Protocol (RESP) request (CVE-2021-32675) * redis: Out of bounds read in lua debugger protocol parser (CVE-2021-32672) For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Container updates: * RHACM 2.1.12 images (BZ# 2007489)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat Advanced Cluster Management for Kubernetes 2.1.12 General Availability release images, which provide security fixes and update the container images.\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Advanced Cluster Management for Kubernetes 2.1.12 images\n\nRed Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console\u2014with security policy built in.\n\nThis advisory contains updates to one or more container images for Red Hat Advanced Cluster Management for Kubernetes. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.1/html/release_notes/\n\nSecurity fixes:\n\n* redis: Lua scripts can overflow the heap-based Lua stack (CVE-2021-32626)\n\n* redis: Integer overflow issue with Streams (CVE-2021-32627)\n\n* redis: Integer overflow bug in the ziplist data structure\n(CVE-2021-32628)\n\n* redis: Integer overflow issue with intsets (CVE-2021-32687)\n\n* redis: Integer overflow issue with strings (CVE-2021-41099)\n\n* redis: Denial of service via Redis Standard Protocol (RESP) request (CVE-2021-32675)\n\n* redis: Out of bounds read in lua debugger protocol parser (CVE-2021-32672)\n\nFor more details about the security issues, including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section.\n\nContainer updates:\n\n* RHACM 2.1.12 images (BZ# 2007489)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2021:3949",
        "url": "https://access.redhat.com/errata/RHSA-2021:3949"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2007489",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2007489"
      },
      {
        "category": "external",
        "summary": "2010991",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2010991"
      },
      {
        "category": "external",
        "summary": "2011000",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2011000"
      },
      {
        "category": "external",
        "summary": "2011001",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2011001"
      },
      {
        "category": "external",
        "summary": "2011004",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2011004"
      },
      {
        "category": "external",
        "summary": "2011010",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2011010"
      },
      {
        "category": "external",
        "summary": "2011017",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2011017"
      },
      {
        "category": "external",
        "summary": "2011020",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2011020"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3949.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.1.12 security fixes and container updates",
    "tracking": {
      "current_release_date": "2024-11-22T17:22:04+00:00",
      "generator": {
        "date": "2024-11-22T17:22:04+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2021:3949",
      "initial_release_date": "2021-10-20T19:44:16+00:00",
      "revision_history": [
        {
          "date": "2021-10-20T19:44:16+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2021-10-20T19:44:16+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T17:22:04+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Advanced Cluster Management for Kubernetes 2.1 for RHEL 8",
                "product": {
                  "name": "Red Hat Advanced Cluster Management for Kubernetes 2.1 for RHEL 8",
                  "product_id": "8Base-RHACM-2.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:acm:2.1::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat ACM"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64",
                "product": {
                  "name": "rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64",
                  "product_id": "rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62?arch=amd64\u0026repository_url=registry.redhat.io/rhacm2/acm-must-gather-rhel8\u0026tag=v2.1.12-1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.1 for RHEL 8",
          "product_id": "8Base-RHACM-2.1:rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64"
        },
        "product_reference": "rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64",
        "relates_to_product_reference": "8Base-RHACM-2.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Meir Shpilraien"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2021-32626",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2021-10-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2011017"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A heap buffer overflow was found in redis. Specially crafted Lua scripts executing in Redis cause the heap-based Lua stack to overflow due to incomplete checks for this condition. This flaw allows a remote attacker to corrupt the heap and potentially trigger remote code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "redis: Lua scripts can overflow the heap-based Lua stack",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHACM-2.1:rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-32626"
        },
        {
          "category": "external",
          "summary": "RHBZ#2011017",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2011017"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-32626",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-32626"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-32626",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32626"
        },
        {
          "category": "external",
          "summary": "https://github.com/redis/redis/security/advisories/GHSA-p486-xggp-782c",
          "url": "https://github.com/redis/redis/security/advisories/GHSA-p486-xggp-782c"
        }
      ],
      "release_date": "2021-10-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-10-20T19:44:16+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\n*Important:* This upgrade of Red Hat Advanced Cluster Management for Kubernetes \nis not supported when you are running Red Hat Advanced Cluster Management on \nRed Hat OpenShift Container Platform version 4.5. To apply this upgrade, you \nmust upgrade your OpenShift Container Platform version to 4.6, or later. \n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.1/html/install/installing#upgrading-by-using-the-operator",
          "product_ids": [
            "8Base-RHACM-2.1:rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:3949"
        },
        {
          "category": "workaround",
          "details": "Prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands. Please see https://redis.io/topics/acl for more information on how to do this.",
          "product_ids": [
            "8Base-RHACM-2.1:rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHACM-2.1:rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "redis: Lua scripts can overflow the heap-based Lua stack"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "sundb"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2021-32627",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2021-10-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2011010"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An integer overflow issue was found in redis. The vulnerability involves changing the default \"proto-max-bulk-len\" and \"client-query-buffer-limit\" configuration parameters to very large values and constructing specially crafted large stream elements. This flaw allows a remote attacker to corrupt the heap and potentially trigger remote code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "redis: Integer overflow issue with Streams",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHACM-2.1:rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-32627"
        },
        {
          "category": "external",
          "summary": "RHBZ#2011010",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2011010"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-32627",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-32627"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-32627",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32627"
        },
        {
          "category": "external",
          "summary": "https://github.com/redis/redis/security/advisories/GHSA-f434-69fm-g45v",
          "url": "https://github.com/redis/redis/security/advisories/GHSA-f434-69fm-g45v"
        }
      ],
      "release_date": "2021-10-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-10-20T19:44:16+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\n*Important:* This upgrade of Red Hat Advanced Cluster Management for Kubernetes \nis not supported when you are running Red Hat Advanced Cluster Management on \nRed Hat OpenShift Container Platform version 4.5. To apply this upgrade, you \nmust upgrade your OpenShift Container Platform version to 4.6, or later. \n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.1/html/install/installing#upgrading-by-using-the-operator",
          "product_ids": [
            "8Base-RHACM-2.1:rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:3949"
        },
        {
          "category": "workaround",
          "details": "The flaw can be mitigated by disallowing usage of the CONFIG SET command via ACL configuration. This will prevent clients from setting the `proto-max-bulk-len` configuration parameter. Please see https://redis.io/topics/acl for more information on how to do this.",
          "product_ids": [
            "8Base-RHACM-2.1:rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHACM-2.1:rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "redis: Integer overflow issue with Streams"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "sundb"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2021-32628",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2021-10-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2011004"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An integer overflow issue was found in the redis ziplist data structure. The vulnerability involves modifying the default ziplist configuration parameters (hash-max-ziplist-entries, hash-max-ziplist-value, zset-max-ziplist-entries or zset-max-ziplist-value) to a very large value, and then constructing specially crafted commands to create very large ziplists. This flaw allows a remote attacker to corrupt the heap and potentially trigger remote code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "redis: Integer overflow bug in the ziplist data structure",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHACM-2.1:rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-32628"
        },
        {
          "category": "external",
          "summary": "RHBZ#2011004",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2011004"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-32628",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-32628"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-32628",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32628"
        },
        {
          "category": "external",
          "summary": "https://github.com/redis/redis/security/advisories/GHSA-vw22-qm3h-49pr",
          "url": "https://github.com/redis/redis/security/advisories/GHSA-vw22-qm3h-49pr"
        }
      ],
      "release_date": "2021-10-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-10-20T19:44:16+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\n*Important:* This upgrade of Red Hat Advanced Cluster Management for Kubernetes \nis not supported when you are running Red Hat Advanced Cluster Management on \nRed Hat OpenShift Container Platform version 4.5. To apply this upgrade, you \nmust upgrade your OpenShift Container Platform version to 4.6, or later. \n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.1/html/install/installing#upgrading-by-using-the-operator",
          "product_ids": [
            "8Base-RHACM-2.1:rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:3949"
        },
        {
          "category": "workaround",
          "details": "The flaw can be mitigated by disallowing usage of the CONFIG SET command via ACL configuration. This will prevent clients from setting the above configuration parameters. Please see https://redis.io/topics/acl for more information on how to do this.",
          "product_ids": [
            "8Base-RHACM-2.1:rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHACM-2.1:rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "redis: Integer overflow bug in the ziplist data structure"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Meir Shpilraien"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2021-32672",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2021-10-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2011001"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in redis. When using the Redis Lua Debugger, users can send malformed requests that cause the debugger\u2019s protocol parser to read data beyond the actual buffer, potentially leading to an information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "redis: Out of bounds read in lua debugger protocol parser",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHACM-2.1:rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-32672"
        },
        {
          "category": "external",
          "summary": "RHBZ#2011001",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2011001"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-32672",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-32672"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-32672",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32672"
        },
        {
          "category": "external",
          "summary": "https://github.com/redis/redis/security/advisories/GHSA-9mj9-xx53-qmxm",
          "url": "https://github.com/redis/redis/security/advisories/GHSA-9mj9-xx53-qmxm"
        }
      ],
      "release_date": "2021-10-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-10-20T19:44:16+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\n*Important:* This upgrade of Red Hat Advanced Cluster Management for Kubernetes \nis not supported when you are running Red Hat Advanced Cluster Management on \nRed Hat OpenShift Container Platform version 4.5. To apply this upgrade, you \nmust upgrade your OpenShift Container Platform version to 4.6, or later. \n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.1/html/install/installing#upgrading-by-using-the-operator",
          "product_ids": [
            "8Base-RHACM-2.1:rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:3949"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHACM-2.1:rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "redis: Out of bounds read in lua debugger protocol parser"
    },
    {
      "cve": "CVE-2021-32675",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2021-10-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2011000"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in redis. When parsing an incoming Redis Standard Protocol (RESP) request, redis allocates memory according to user-specified values, which determine the number of elements (in the multi-bulk header) and size of each element (in the bulk header). This flaw allows an unauthenticated, remote user delivering specially crafted requests over multiple connections to cause the server to allocate a significant amount of memory, resulting in a denial of service. The highest threat from this vulnerability is to system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "redis: Denial of service via Redis Standard Protocol (RESP) request",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHACM-2.1:rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-32675"
        },
        {
          "category": "external",
          "summary": "RHBZ#2011000",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2011000"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-32675",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-32675"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-32675",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32675"
        },
        {
          "category": "external",
          "summary": "https://github.com/redis/redis/security/advisories/GHSA-f6pw-v9gw-v64p",
          "url": "https://github.com/redis/redis/security/advisories/GHSA-f6pw-v9gw-v64p"
        }
      ],
      "release_date": "2021-10-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-10-20T19:44:16+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\n*Important:* This upgrade of Red Hat Advanced Cluster Management for Kubernetes \nis not supported when you are running Red Hat Advanced Cluster Management on \nRed Hat OpenShift Container Platform version 4.5. To apply this upgrade, you \nmust upgrade your OpenShift Container Platform version to 4.6, or later. \n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.1/html/install/installing#upgrading-by-using-the-operator",
          "product_ids": [
            "8Base-RHACM-2.1:rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:3949"
        },
        {
          "category": "workaround",
          "details": "Prevent unauthenticated users from connecting to Redis by using network access control tools (e.g., firewalls) or enabling TLS and requiring users to authenticate using client side certificates.",
          "product_ids": [
            "8Base-RHACM-2.1:rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHACM-2.1:rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "redis: Denial of service via Redis Standard Protocol (RESP) request"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Pawel Wieczorkiewicz"
          ],
          "organization": "Amazon Web Services",
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2021-32687",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2021-10-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2010991"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An integer overflow issue was found in redis. The vulnerability involves changing the default \"set-max-intset-entries\" configuration parameter to a very large value and constructing specially crafted commands to manipulate sets. This flaw allows a remote attacker to leak arbitrary contents of the heap or potentially trigger remote code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "redis: Integer overflow issue with intsets",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHACM-2.1:rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-32687"
        },
        {
          "category": "external",
          "summary": "RHBZ#2010991",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2010991"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-32687",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-32687"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-32687",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32687"
        },
        {
          "category": "external",
          "summary": "https://github.com/redis/redis/security/advisories/GHSA-m3mf-8x9w-r27q",
          "url": "https://github.com/redis/redis/security/advisories/GHSA-m3mf-8x9w-r27q"
        }
      ],
      "release_date": "2021-10-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-10-20T19:44:16+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\n*Important:* This upgrade of Red Hat Advanced Cluster Management for Kubernetes \nis not supported when you are running Red Hat Advanced Cluster Management on \nRed Hat OpenShift Container Platform version 4.5. To apply this upgrade, you \nmust upgrade your OpenShift Container Platform version to 4.6, or later. \n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.1/html/install/installing#upgrading-by-using-the-operator",
          "product_ids": [
            "8Base-RHACM-2.1:rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:3949"
        },
        {
          "category": "workaround",
          "details": "The flaw can be mitigated by disallowing usage of the CONFIG SET command via ACL configuration. This will prevent clients from setting the `set-max-intset-entries` configuration parameter. Please see https://redis.io/topics/acl for more information on how to do this.",
          "product_ids": [
            "8Base-RHACM-2.1:rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHACM-2.1:rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "redis: Integer overflow issue with intsets"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "yiyuaner"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2021-41099",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2021-10-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2011020"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An integer overflow issue was found in redis in the underlying string library. The vulnerability involves changing the default \"proto-max-bulk-len\" configuration parameter to a very large value and constructing specially crafted network payloads or commands. This flaw allows a remote attacker to corrupt the heap and potentially trigger remote code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "redis: Integer overflow issue with strings",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHACM-2.1:rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-41099"
        },
        {
          "category": "external",
          "summary": "RHBZ#2011020",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2011020"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-41099",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-41099"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-41099",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41099"
        },
        {
          "category": "external",
          "summary": "https://github.com/redis/redis/security/advisories/GHSA-j3cr-9h5g-6cph",
          "url": "https://github.com/redis/redis/security/advisories/GHSA-j3cr-9h5g-6cph"
        }
      ],
      "release_date": "2021-10-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-10-20T19:44:16+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\n*Important:* This upgrade of Red Hat Advanced Cluster Management for Kubernetes \nis not supported when you are running Red Hat Advanced Cluster Management on \nRed Hat OpenShift Container Platform version 4.5. To apply this upgrade, you \nmust upgrade your OpenShift Container Platform version to 4.6, or later. \n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.1/html/install/installing#upgrading-by-using-the-operator",
          "product_ids": [
            "8Base-RHACM-2.1:rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:3949"
        },
        {
          "category": "workaround",
          "details": "The flaw can be mitigated by disallowing usage of the CONFIG SET command via ACL configuration. This will prevent clients from setting the `proto-max-bulk-len` configuration parameter. Please see https://redis.io/topics/acl for more information on how to do this.",
          "product_ids": [
            "8Base-RHACM-2.1:rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHACM-2.1:rhacm2/acm-must-gather-rhel8@sha256:382ae2f9e7e8fcca18bb29f29994bc7f30ba24b810ad127a35254ddef7900f62_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "redis: Integer overflow issue with strings"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.