Integer overflow in Redis - CVE-2021-32762

Vulnerability identifier: #VU57030

CSH Severity: Medium

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-32762

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow when handling large multi-bulk replies on some older and less common platforms in redis-cli and redis-sentinel. A remote attacker can pass specially crafted data to the application, trigger an integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Redis
Gentoo Linux
SUSE Linux Enterprise Module for Server Applications
openEuler
Fedora
Event Streams
redis (Debian package)
redis5-devel
redis5-debuginfo
redis5-debugsource
redis5
redis5-doc
redis6-doc
redis6-debuginfo
redis6
redis6-devel
redis6-debugsource
redis-debugsource
redis-debuginfo
redis
dev-db/redis
Robotic Process Automation for Cloud Pak

Install updates from vendor's website.

Redis - addressed in versions 5.0.14, 6.0.16, 6.2.6
Event Streams - addressed in versions 10.2.1, 10.5.0, 2019.4.5
redis (Debian package) - addressed in versions 5:5.0.14-1+deb10u1, 5:6.0.16-1+deb11u1
redis5-devel - update to 5.0.14-2
redis5-debuginfo - update to 5.0.14-2
redis5-debugsource - update to 5.0.14-2
redis5 - update to 5.0.14-2
redis5-doc - update to 5.0.14-2
redis6-doc - addressed in versions 6.0.11-6, 6.2.7-1
redis6-debuginfo - addressed in versions 6.0.11-6, 6.2.7-1
redis6 - addressed in versions 6.0.11-6, 6.2.7-1
redis6-devel - addressed in versions 6.0.11-6, 6.2.7-1
redis6-debugsource - addressed in versions 6.0.11-6, 6.2.7-1
redis-debugsource - update to 6.0.14-6.8.1
redis-debuginfo - update to 6.0.14-6.8.1
redis - update to 6.0.14-6.8.1
redis - addressed in versions 6.0.16-1.fc33, 6.2.6-1.fc34, 6.2.6-1.fc35
redis-debugsource - update to 7.2.7-1
redis - update to 7.2.7-1
redis-debuginfo - update to 7.2.7-1
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.6, 23.0.7
dev-db/redis - update to 7.0.5

• https://github.com/redis/redis/releases/tag/5.0.14
• https://github.com/antirez/redis/releases/tag/6.0.16
• https://github.com/antirez/redis/releases/tag/6.2.6
• https://github.com/redis/redis/security/advisories/GHSA-833w-8v3m-8wwr

• Multiple vulnerabilities in Redis
• Debian update for redis
• IBM Event Streams update for Redis
• SUSE update for redis
• Gentoo update for Redis
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• openEuler update for redis5
• openEuler update for redis6
• openEuler 20.03 LTS SP3 update for redis6
• openEuler 20.03 LTS SP3 update for redis5
• Fedora 33 update for redis
• Fedora 34 update for redis
• Fedora 35 update for redis
• openEuler update for redis