CVE-2021-29477
Summary
| CVE | CVE-2021-29477 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2021-05-04 16:15:00 UTC |
|---|
| Updated | 2023-11-07 03:32:00 UTC |
|---|
| Description | Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer could be exploited using the `STRALGO LCS` command to corrupt the heap and potentially result with remote code execution. The problem is fixed in version 6.2.3 and 6.0.13. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the `STRALGO LCS` command. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| [SECURITY] Fedora 34 Update: redis-6.2.4-1.fc34 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| Redis |
MISC |
redis.io |
|
| [SECURITY] Fedora 33 Update: redis-6.0.13-1.fc33 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| Vulnerability in the STRALGO LCS command · Advisory · redis/redis · GitHub |
CONFIRM |
github.com |
|
| [SECURITY] Fedora 33 Update: redis-6.0.14-1.fc33 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] Fedora 33 Update: redis-6.0.13-1.fc33 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| [SECURITY] Fedora 34 Update: redis-6.2.4-1.fc34 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| [SECURITY] Fedora 34 Update: redis-6.2.3-1.fc34 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] Fedora 34 Update: redis-6.2.3-1.fc34 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| Redis: Multiple vulnerabilities (GLSA 202107-20) — Gentoo security |
GENTOO |
security.gentoo.org |
|
| [SECURITY] Fedora 33 Update: redis-6.0.14-1.fc33 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 159233 Oracle Enterprise Linux Security Update for redis:6 (ELSA-2021-2034)
- 180572 Debian Security Update for redis (CVE-2021-29477)
- 239356 Red Hat Update for redis:6 (RHSA-2021:2034)
- 281198 Fedora Security Update for redis (FEDORA-2021-8b19c99d6a)
- 281199 Fedora Security Update for redis (FEDORA-2021-3b267a756c)
- 281625 Fedora Security Update for redis (FEDORA-2021-916f861096)
- 281626 Fedora Security Update for redis (FEDORA-2021-0ad4bec5b1)
- 356192 Amazon Linux Security Advisory for redis : ALASREDIS6-2023-008
- 356470 Amazon Linux Security Advisory for redis : ALAS2REDIS6-2023-008
- 501482 Alpine Linux Security Update for redis
- 502979 Alpine Linux Security Update for redis
- 690152 Free Berkeley Software Distribution (FreeBSD) Security Update for redis (1606b03b-ac57-11eb-9bdd-8c164567ca3c)
- 710056 Gentoo Linux Redis Multiple vulnerabilities (GLSA 202107-20)
- 750019 SUSE Enterprise Linux Security Update for redis (SUSE-SU-2021:1652-1)
- 750226 OpenSUSE Security Update for redis (openSUSE-SU-2021:0682-1)
- 940319 AlmaLinux Security Update for redis:6 (ALSA-2021:2034)
- 960078 Rocky Linux Security Update for redis:6 (RLSA-2021:2034)
