Integer overflow in Redis - CVE-2021-21309

Vulnerability identifier: #VU50853

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-21309

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow on 32-bit systems. A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Redis
Gentoo Linux
SUSE Linux Enterprise Module for Server Applications
openEuler
redis (Alpine package)
redis
redis-debuginfo
redis-debugsource
Robotic Process Automation for Cloud Pak

Install updates from vendor's website.

Redis - addressed in versions 5.0.11, 6.0.11, 6.2.0
redis (Alpine package) - addressed in versions 5.0.11-r0, 6.0.11-r0
redis - update to 4.0.11-13
redis-debuginfo - update to 4.0.11-13
redis-debugsource - update to 4.0.11-13
redis - update to 6.0.13-1.10.1
redis-debuginfo - update to 6.0.13-1.10.1
redis-debugsource - update to 6.0.13-1.10.1
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.6, 23.0.7

• https://github.com/redis/redis/releases/tag/6.2.0
• https://github.com/redis/redis/releases/tag/5.0.11

• Integer overflow in Redis
• Integer overflow in redis (Alpine package)
• Gentoo update for Redis
• SUSE update for redis
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• openEuler update for redis