Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2021-31294

Опубликовано: 15 июл. 2023
Источник: redhat
CVSS3: 5.9
EPSS Низкий

Описание

Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command (specifically, a SET command). NOTE: this was fixed for Redis 6.2.x and 7.x in 2021. Versions before 6.2 were not intended to have safety guarantees related to this.

A flaw was found in the Redis package. If a replica sends a SET command to its master during a failover, the master crashes on assertion.

Отчет

Within regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-617: Reachable Assertion vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low. Red Hat enforces strict input validation to ensure all user-supplied data conforms to expected formats and boundaries, reducing the likelihood that malformed input could trigger unintended application states. Assertions and other insecure constructs are identified through static code analysis and peer reviews, and are excluded from production builds to prevent exposure of internal logic or disruption of system behavior. Error-handling routines ensure that invalid conditions are managed gracefully without causing unpredictable behavior or system instability. Additionally, system components are designed to fail in a known, controlled state, minimizing the risk and impact of reachable assertion conditions in the environment.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat 3scale API Management Platform 23scale-amp-backend-containerAffected
Red Hat 3scale API Management Platform 23scale-amp-system-containerWill not fix
Red Hat Advanced Cluster Management for Kubernetes 2rhacm2/search-api-rhel8Not affected
Red Hat Ansible Automation Platform 1.2ansible-towerAffected
Red Hat Enterprise Linux 8redis:6/redisWill not fix
Red Hat Enterprise Linux 9redisNot affected
Red Hat Fuse 7redisWill not fix
Red Hat OpenStack Platform 16.1openstack-redis-base-containerNot affected
Red Hat OpenStack Platform 16.1openstack-redis-containerWill not fix
Red Hat OpenStack Platform 17.0openstack-redis-containerNot affected

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-617
https://bugzilla.redhat.com/show_bug.cgi?id=2223393redis: an assertion failure in a primary server by sending a non-administrative command

EPSS

Процентиль: 44%
0.00214
Низкий

5.9 Medium

CVSS3

Связанные уязвимости

CVSS3: 5.9
ubuntu
больше 2 лет назад

Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command (specifically, a SET command). NOTE: this was fixed for Redis 6.2.x and 7.x in 2021. Versions before 6.2 were not intended to have safety guarantees related to this.

CVSS3: 5.9
nvd
больше 2 лет назад

Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command (specifically, a SET command). NOTE: this was fixed for Redis 6.2.x and 7.x in 2021. Versions before 6.2 were not intended to have safety guarantees related to this.

CVSS3: 5.9
debian
больше 2 лет назад

Redis before 6cbea7d allows a replica to cause an assertion failure in ...

CVSS3: 7.5
github
больше 2 лет назад

Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command (specifically, a SET command). NOTE: this was fixed for Redis 6.2.x and 7.x in 2021. Versions before 6.2 were not intended to have safety guarantees related to this.

EPSS

Процентиль: 44%
0.00214
Низкий

5.9 Medium

CVSS3