CVE-2021-32672

Опубликовано: 04 окт. 2021

Источник: nvd

CVSS3: 5.3

CVSS3: 4.3

CVSS2: 4

EPSS Низкий

Описание

Redis is an open source, in-memory database that persists on disk. When using the Redis Lua Debugger, users can send malformed requests that cause the debugger’s protocol parser to read data beyond the actual buffer. This issue affects all versions of Redis with Lua debugging support (3.2 or newer). The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14.

Ссылки

https://github.com/redis/redis/commit/6ac3c0b7abd35f37201ed2d6298ecef4ea1ae1dd
Patch
Third Party Advisory
https://github.com/redis/redis/security/advisories/GHSA-9mj9-xx53-qmxm
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/
https://security.gentoo.org/glsa/202209-17
Third Party Advisory
https://security.netapp.com/advisory/ntap-20211104-0003/
Third Party Advisory
https://www.debian.org/security/2021/dsa-5001
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory
https://github.com/redis/redis/commit/6ac3c0b7abd35f37201ed2d6298ecef4ea1ae1dd
Patch
Third Party Advisory
https://github.com/redis/redis/security/advisories/GHSA-9mj9-xx53-qmxm
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/
https://security.gentoo.org/glsa/202209-17
Third Party Advisory
https://security.netapp.com/advisory/ntap-20211104-0003/
Third Party Advisory
https://www.debian.org/security/2021/dsa-5001
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*

Версия от 3.2.0 (включая) до 5.0.14 (исключая)

cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*

Версия от 6.0.0 (включая) до 6.0.16 (исключая)

cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*

Версия от 6.2.0 (включая) до 6.2.6 (исключая)

Конфигурация 2

Одно из

cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:management_services_for_netapp_hci:-:*:*:*:*:*:*:*

Конфигурация 6

Одно из

cpe:2.3:a:oracle:communications_operations_monitor:4.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_operations_monitor:4.4:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_operations_monitor:5.0:*:*:*:*:*:*:*

EPSS

Процентиль: 52%

0.00287

Низкий

5.3 Medium

CVSS3

4.3 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-125

Связанные уязвимости

CVE-2021-32672

CVSS3: 5.3

ubuntu

больше 4 лет назад

CVE-2021-32672

CVSS3: 3.1

redhat

больше 4 лет назад

CVE-2021-32672

CVSS3: 4.3

msrc

больше 4 лет назад

Vulnerability in Lua Debugger in Redis

CVE-2021-32672

CVSS3: 5.3

debian

больше 4 лет назад

Redis is an open source, in-memory database that persists on disk. Whe ...

BDU:2023-02451

CVSS3: 4.3

fstec

больше 4 лет назад

Уязвимость системы управления базами данных NoSQL Redis, связанная с чтением за границами буфера, позволяющая нарушителю получить доступ к конфиденциальным данным

EPSS

Процентиль: 52%

0.00287

Низкий

5.3 Medium

CVSS3

4.3 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-125