Resource exhaustion in node-redis - CVE-2021-29469
Published: September 29, 2021
Vulnerability identifier: #VU56912
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-29469
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a regular expression denial of service (ReDoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources, when a client is in monitoring mode. A remote attacker can trigger resource exhaustion and perform a regular expression denial of service (ReDoS) attack.
Affected software
node-redis
Cloud Pak for Security (CP4S)
IBM Cloud Automation Manager
IBM Cloud Application Performance Management (APM)
IBM Cognos Analytics
Cloud Pak for Security (CP4S)
IBM Cloud Automation Manager
IBM Cloud Application Performance Management (APM)
IBM Cognos Analytics
How to mitigate CVE-2021-29469
Install updates from vendor's website.
node-redis - update to 3.1.1
Cloud Pak for Security (CP4S) - update to 1.10.7.0
IBM Cognos Analytics - addressed in versions 11.1.7.6, 11.2.4
Cloud Pak for Security (CP4S) - update to 1.10.7.0
IBM Cognos Analytics - addressed in versions 11.1.7.6, 11.2.4