Out-of-bounds read in Redis - CVE-2021-32672

Vulnerability identifier: #VU57035

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-32672

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition, related to Lua Debugger. A remote attacker can read random data from heap.

Redis
Gentoo Linux
Ubuntu
SUSE Linux Enterprise Module for Server Applications
openEuler
Fedora
Red Hat Advanced Cluster Management for Kubernetes
IBM Cloud Pak for Multicloud Management Monitoring
redis (Debian package)
redis-server (Ubuntu package)
redis-tools (Ubuntu package)
redis (Ubuntu package)
redis
redis-debuginfo
redis-debugsource
redis6-doc
redis6-debugsource
redis6-debuginfo
redis6
redis6-devel
dev-db/redis
Robotic Process Automation for Cloud Pak

Install updates from vendor's website.

Redis - addressed in versions 5.0.14, 6.0.16, 6.2.6
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.1.12, 2.3.3
redis (Debian package) - addressed in versions 5:5.0.14-1+deb10u1, 5:6.0.16-1+deb11u1
redis-server (Ubuntu package) - addressed in versions 2:2.8.4-2ubuntu0.2+esm2, 2:3.0.6-1ubuntu0.4+esm1
redis-tools (Ubuntu package) - addressed in versions 2:2.8.4-2ubuntu0.2+esm2, 2:3.0.6-1ubuntu0.4+esm1, 5:4.0.9-1ubuntu0.2+esm3, 5:5.0.7-2ubuntu0.1+esm1
redis (Ubuntu package) - addressed in versions 5:4.0.9-1ubuntu0.2+esm3, 5:5.0.7-2ubuntu0.1+esm1
redis - update to 4.0.11-16
redis-debuginfo - update to 4.0.11-16
redis-debugsource - update to 4.0.11-16
redis - update to 6.0.14-6.8.1
redis-debuginfo - update to 6.0.14-6.8.1
redis-debugsource - update to 6.0.14-6.8.1
redis - addressed in versions 6.0.16-1.fc33, 6.2.6-1.fc34, 6.2.6-1.fc35
redis6-doc - update to 6.2.7-1
redis6-debugsource - update to 6.2.7-1
redis6-debuginfo - update to 6.2.7-1
redis6 - update to 6.2.7-1
redis6-devel - update to 6.2.7-1
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.6, 23.0.7
dev-db/redis - update to 7.0.5

• https://github.com/redis/redis/releases/tag/5.0.14
• https://github.com/antirez/redis/releases/tag/6.0.16
• https://github.com/antirez/redis/releases/tag/6.2.6
• https://github.com/redis/redis/security/advisories/GHSA-9mj9-xx53-qmxm

• Multiple vulnerabilities in Redis
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.3
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.1
• Debian update for redis
• SUSE update for redis
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management Monitoring
• Gentoo update for Redis
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• openEuler update for redis
• openEuler update for redis6
• Fedora 33 update for redis
• Fedora 34 update for redis
• Fedora 35 update for redis
• Ubuntu update for redis