CVE-2021-32672

Published: Oct 4, 2021Modified: Nov 21, 2024

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

Redis is an open source, in-memory database that persists on disk. When using the Redis Lua Debugger, users can send malformed requests that cause the debugger’s protocol parser to read data beyond the actual buffer. This issue affects all versions of Redis with Lua debugging support (3.2 or newer). The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14.

Affected (15)

Products: Redis: Redis · Redhat: Enterprise Linux, Software Collections · Debian: Debian Linux · +3 more

Show all products

Redis: Redis · Redhat: Enterprise Linux, Software Collections · Debian: Debian Linux · Fedoraproject: Fedora · Netapp: Management Services For Element Software, Management Services For Netapp Hci · Oracle: Communications Operations Monitor

1 product

2 products

Enterprise Linux

Software Collections

1 product

1 product

2 products

Management Services For Element Software

Management Services For Netapp Hci

1 product

Communications Operations Monitor

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Redis Redis	From 3.2.0 to 5.0.14
Redis Redis	From 6.0.0 to 6.0.16
Redis Redis	From 6.2.0 to 6.2.6

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 8.0
Redhat Software Collections	All versions

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 11.0

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 33
Fedoraproject Fedora	Version 34
Fedoraproject Fedora	Version 35

Configuration E

2 vulnerable

Vulnerable Software	Affected Versions
Netapp Management Services For Element Software	All versions
Netapp Management Services For Netapp Hci	All versions

Configuration F

3 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Operations Monitor	Version 4.3
Oracle Communications Operations Monitor	Version 4.4
Oracle Communications Operations Monitor	Version 5.0

Related CWEs

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References (18)

https://github.com/redis/redis/commit/6ac3c0b7abd35f37201ed2d6298ecef4ea1ae1dd

Source: security-advisories@github.com

PatchThird Party Advisory

https://github.com/redis/redis/security/advisories/GHSA-9mj9-xx53-qmxm

Source: security-advisories@github.com

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/

Source: security-advisories@github.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/

Source: security-advisories@github.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/

Source: security-advisories@github.com

https://security.gentoo.org/glsa/202209-17

Source: security-advisories@github.com

Third Party Advisory

https://security.netapp.com/advisory/ntap-20211104-0003/

Source: security-advisories@github.com

Third Party Advisory

https://www.debian.org/security/2021/dsa-5001

Source: security-advisories@github.com

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: security-advisories@github.com

PatchThird Party Advisory

https://github.com/redis/redis/commit/6ac3c0b7abd35f37201ed2d6298ecef4ea1ae1dd

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/redis/redis/security/advisories/GHSA-9mj9-xx53-qmxm

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.gentoo.org/glsa/202209-17

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.netapp.com/advisory/ntap-20211104-0003/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.debian.org/security/2021/dsa-5001

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.