CVE-2021-32675
DoS vulnerability in Redis
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Redis is an open source, in-memory database that persists on disk. When parsing an incoming Redis Standard Protocol (RESP) request, Redis allocates memory according to user-specified values which determine the number of elements (in the multi-bulk header) and size of each element (in the bulk header). An attacker delivering specially crafted requests over multiple connections can cause the server to allocate significant amount of memory. Because the same parsing mechanism is used to handle authentication requests, this vulnerability can also be exploited by unauthenticated users. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. An additional workaround to mitigate this problem without patching the redis-server executable is to block access to prevent unauthenticated users from connecting to Redis. This can be done in different ways: Using network access control tools like firewalls, iptables, security groups, etc. or Enabling TLS and requiring users to authenticate using client side certificates.
Redis es una base de datos en memoria de código abierto que persiste en el disco. Cuando es analizada una petición entrante del Protocolo Estándar de Redis (RESP), Redis asigna la memoria de acuerdo con los valores especificados por el usuario, que determinan el número de elementos (en el encabezado multi-bulk) y el tamaño de cada elemento (en el encabezado bulk). Un atacante que envíe peticiones especialmente diseñadas a través de múltiples conexiones puede causar que el servidor asigne una cantidad significativa de memoria. Debido a que el mismo mecanismo de análisis es usado para manejar las peticiones de autenticación, esta vulnerabilidad también puede ser explotada por usuarios no autenticados. El problema se ha corregido en las versiones de Redis 6.2.6, 6.0.16 y 5.0.14. Una solución adicional para mitigar este problema sin necesidad de parchear el ejecutable del servidor Redis es bloquear el acceso para evitar que los usuarios no autentificados se conecten a Redis. Esto puede hacerse de diferentes maneras: Usando herramientas de control de acceso a la red como firewalls, iptables, grupos de seguridad, etc. o Habilitando TLS y requiriendo que los usuarios se autentiquen usando certificados del lado del cliente
A flaw was found in redis. When parsing an incoming Redis Standard Protocol (RESP) request, redis allocates memory according to user-specified values, which determine the number of elements (in the multi-bulk header) and size of each element (in the bulk header). This flaw allows an unauthenticated, remote user delivering specially crafted requests over multiple connections to cause the server to allocate a significant amount of memory, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-05-12 CVE Reserved
- 2021-10-04 CVE Published
- 2024-08-03 CVE Updated
- 2024-11-06 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-770: Allocation of Resources Without Limits or Throttling
CAPEC
References (12)
URL | Tag | Source |
---|---|---|
https://github.com/redis/redis/security/advisories/GHSA-f6pw-v9gw-v64p | Third Party Advisory | |
https://lists.apache.org/thread.html/ra603ff6e04549d7f290f61f9b11e2d2e4dba693b05ff053f4ec6bc47%40%3Cnotifications.geode.apache.org%3E | Mailing List | |
https://security.netapp.com/advisory/ntap-20211104-0003 | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://github.com/redis/redis/commit/5674b0057ff2903d43eaff802017eddf37c360f8 | 2023-11-07 | |
https://www.oracle.com/security-alerts/cpuapr2022.html | 2023-11-07 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Redis Search vendor "Redis" | Redis Search vendor "Redis" for product "Redis" | >= 5.0.0 < 5.0.14 Search vendor "Redis" for product "Redis" and version " >= 5.0.0 < 5.0.14" | - |
Affected
| ||||||
Redis Search vendor "Redis" | Redis Search vendor "Redis" for product "Redis" | >= 6.0.0 < 6.0.16 Search vendor "Redis" for product "Redis" and version " >= 6.0.0 < 6.0.16" | - |
Affected
| ||||||
Redis Search vendor "Redis" | Redis Search vendor "Redis" for product "Redis" | >= 6.2.0 < 6.2.6 Search vendor "Redis" for product "Redis" and version " >= 6.2.0 < 6.2.6" | - |
Affected
| ||||||
Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 33 Search vendor "Fedoraproject" for product "Fedora" and version "33" | - |
Affected
| ||||||
Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 34 Search vendor "Fedoraproject" for product "Fedora" and version "34" | - |
Affected
| ||||||
Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 35 Search vendor "Fedoraproject" for product "Fedora" and version "35" | - |
Affected
| ||||||
Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
| ||||||
Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 11.0 Search vendor "Debian" for product "Debian Linux" and version "11.0" | - |
Affected
| ||||||
Netapp Search vendor "Netapp" | Management Services For Element Software Search vendor "Netapp" for product "Management Services For Element Software" | - | - |
Affected
| ||||||
Netapp Search vendor "Netapp" | Management Services For Netapp Hci Search vendor "Netapp" for product "Management Services For Netapp Hci" | - | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Communications Operations Monitor Search vendor "Oracle" for product "Communications Operations Monitor" | 4.3 Search vendor "Oracle" for product "Communications Operations Monitor" and version "4.3" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Communications Operations Monitor Search vendor "Oracle" for product "Communications Operations Monitor" | 4.4 Search vendor "Oracle" for product "Communications Operations Monitor" and version "4.4" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Communications Operations Monitor Search vendor "Oracle" for product "Communications Operations Monitor" | 5.0 Search vendor "Oracle" for product "Communications Operations Monitor" and version "5.0" | - |
Affected
|