CVE-2021-32672

Опубликовано: 04 окт. 2021

Источник: nvd

CVSS3: 5.3

CVSS3: 4.3

CVSS2: 4

EPSS Низкий

Описание

Redis is an open source, in-memory database that persists on disk. When using the Redis Lua Debugger, users can send malformed requests that cause the debugger’s protocol parser to read data beyond the actual buffer. This issue affects all versions of Redis with Lua debugging support (3.2 or newer). The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14.

Ссылки

https://github.com/redis/redis/commit/6ac3c0b7abd35f37201ed2d6298ecef4ea1ae1dd
Patch
Third Party Advisory
https://github.com/redis/redis/security/advisories/GHSA-9mj9-xx53-qmxm
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/
https://security.gentoo.org/glsa/202209-17
Third Party Advisory
https://security.netapp.com/advisory/ntap-20211104-0003/
Third Party Advisory
https://www.debian.org/security/2021/dsa-5001
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory
https://github.com/redis/redis/commit/6ac3c0b7abd35f37201ed2d6298ecef4ea1ae1dd
Patch
Third Party Advisory
https://github.com/redis/redis/security/advisories/GHSA-9mj9-xx53-qmxm
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/
https://security.gentoo.org/glsa/202209-17
Third Party Advisory
https://security.netapp.com/advisory/ntap-20211104-0003/
Third Party Advisory
https://www.debian.org/security/2021/dsa-5001
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*

Версия от 3.2.0 (включая) до 5.0.14 (исключая)

cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*

Версия от 6.0.0 (включая) до 6.0.16 (исключая)

cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*

Версия от 6.2.0 (включая) до 6.2.6 (исключая)

Конфигурация 2

Одно из

cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:management_services_for_netapp_hci:-:*:*:*:*:*:*:*

Конфигурация 6

Одно из

cpe:2.3:a:oracle:communications_operations_monitor:4.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_operations_monitor:4.4:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_operations_monitor:5.0:*:*:*:*:*:*:*

EPSS

Процентиль: 77%

0.01831

Низкий

5.3 Medium

CVSS3

4.3 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-125

Связанные уязвимости

CVE-2021-32672

CVSS3: 5.3

ubuntu

почти 5 лет назад

CVE-2021-32672

CVSS3: 3.1

redhat

почти 5 лет назад

CVE-2021-32672

CVSS3: 4.3

msrc

почти 5 лет назад

Vulnerability in Lua Debugger in Redis

CVE-2021-32672

CVSS3: 5.3

debian

почти 5 лет назад

Redis is an open source, in-memory database that persists on disk. Whe ...

GHSA-9mj9-xx53-qmxm

CVSS3: 3.1

github

почти 5 лет назад

Vulnerability in Lua Debugger

EPSS

Процентиль: 77%

0.01831

Низкий

5.3 Medium

CVSS3

4.3 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-125