Reachable Assertion in Redis - CVE-2021-31294

Vulnerability identifier: #VU84474

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-31294

CWE-ID: CWE-617

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to Redis allows a replica to cause an assertion failure in a primary server. A remote attacker can send a non-administrative command (specifically, a SET command) to perform a denial of service (DoS) attack.

Redis
Guardium Data Security Center (GDSC)
watsonx Code Assistant On Prem
Maximo Application Suite - Visual Inspection Component
IBM Planning Analytics Workspace
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data

Install updates from vendor's website.

Redis - update to 6.2.0
Guardium Data Security Center (GDSC) - update to 3.8.8
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.3.1
watsonx Code Assistant On Prem - update to 5.3.1
Maximo Application Suite - Visual Inspection Component - update to 9.1.18
IBM Planning Analytics Workspace - update to 2.0.91

• https://github.com/redis/redis/commit/46f4ebbe842620f0976a36741a72482620aa4b48
• https://github.com/redis/redis/commit/6cbea7d29b5285692843bc1c351abba1a7ef326f
• https://github.com/redis/redis/issues/8712
• https://security.netapp.com/advisory/ntap-20230814-0007/

• Multiple vulnerabilities in IBM Planning Analytics Workspace
• IBM Watson Speech Services Cartridge update for Redis
• Multiple vulnerabilities in IBM watsonx Code Assistant On Prem
• Multiple vulnerabilities in IBM Guardium Data Security Center
• IBM Maximo Application Suite - Visual Inspection Component update for Redis