CVSS: 8.8EPSS: 1%CPEs: 4EXPL: 0CVE-2021-29477 – Vulnerability in the STRALGO LCS command
https://notcve.org/view.php?id=CVE-2021-29477
Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer could be exploited using the `STRALGO LCS` command to corrupt the heap and potentially result with remote code execution. The problem is fixed in version 6.2.3 and 6.0.13. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the `STRALGO LCS` command. Redis es una estructura de datos en memoria de código abierto (con licencia BSD) almacenado, utilizado como base de datos, caché y agente de mensajes. • https://github.com/redis/redis/security/advisories/GHSA-vqxj-26vj-996g https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BHWOF7CBVUGDK3AN6H3BN3VNTH2TDUZZ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPWBIZXA67JFIB63W2CNVVILCGIC2ME5 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZJ6JGQ2ETZB2DWTQSGCOGG7EF3ILV4V https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SN7INTZFE34MIQJO7WD • CWE-190: Integer Overflow or Wraparound CWE-787: Out-of-bounds Write •
CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 0CVE-2021-3470
https://notcve.org/view.php?id=CVE-2021-3470
A heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when using a heap allocator other than jemalloc or glibc's malloc, leading to potential out of bound write or process crash. Effectively this flaw does not affect the vast majority of users, who use jemalloc or glibc malloc. Se encontró un problema de desbordamiento de pila en Redis en las versiones anteriores a 5.0.10, versiones anteriores a 6.0.9 y versiones anteriores a 6.2.0, cuando se usaba un asignador de pila que no fuera jemalloc o malloc de glibc, conllevando a un posible bloqueo del proceso o de escritura fuera de límites. Efectivamente, este fallo no afecta a la gran mayoría de usuarios que usan jemalloc o glibc malloc. • https://bugzilla.redhat.com/show_bug.cgi?id=1943623 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-21309 – Integer overflow on 32-bit systems
https://notcve.org/view.php?id=CVE-2021-21309
Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer overflow scenarios, which would result with buffer overflow and heap corruption. • https://github.com/redis/redis/commit/c992857618db99776917f10bf4f2345a5fdc78b0 https://github.com/redis/redis/pull/8522 https://github.com/redis/redis/security/advisories/GHSA-hgj8-vff2-7cjf https://security.gentoo.org/glsa/202103-02 https://access.redhat.com/security/cve/CVE-2021-21309 https://bugzilla.redhat.com/show_bug.cgi?id=1932634 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-190: Integer Overflow or Wraparound •
CVSS: 7.7EPSS: 0%CPEs: 8EXPL: 0CVE-2020-14147
https://notcve.org/view.php?id=CVE-2020-14147
An integer overflow in the getnum function in lua_struct.c in Redis before 6.0.3 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow. NOTE: this issue exists because of a CVE-2015-8080 regression. Un desbordamiento de enteros en la función getnum en el archivo lua_struct.c en Redis versiones anteriores a 6.0.3, permite a atacantes dependiendo del contexto, con permiso para ejecutar el código Lua en una sesión de Redis, causar una denegación de servicio (corrupción de la memoria y bloqueo de la aplicación) o posiblemente omitir las restricciones del sandbox previstas por medio de un número grande, lo que desencadena un desbordamiento de búfer en la región stack de la pila. NOTA: este problema se presenta debido a una regresión de CVE-2015-8080 • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00058.html https://github.com/antirez/redis/commit/ef764dde1cca2f25d00686673d1bc89448819571 https://github.com/antirez/redis/pull/6875 https://security.gentoo.org/glsa/202008-17 https://www.debian.org/security/2020/dsa-4731 https://www.oracle.com/security-alerts/cpujan2021.html • CWE-190: Integer Overflow or Wraparound CWE-787: Out-of-bounds Write •