CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
88.7%
Severity: High
Date : 2021-06-01
CVE-ID : CVE-2021-32625
Package : redis
Type : arbitrary code execution
Remote : Yes
Link : https://security.archlinux.org/AVG-2022
The package redis before version 6.2.4-1 is vulnerable to arbitrary
code execution.
Upgrade to 6.2.4-1.
The problem has been fixed upstream in version 6.2.4.
A workaround to mitigate the problem is to use an ACL configuration to
prevent clients from using the STRALGO LCS command.
On systems running Redis version 6.2.3, it is sufficient to make sure
that the proto-max-bulk-len config parameter is smaller than 2GB
(default is 512MB).
An integer overflow bug in Redis versions 6.0 up to 6.2.3 can be
exploited using the STRALGO LCS command to corrupt the heap and
potentially result in remote code execution. This is a result of an
incomplete fix of CVE-2021-29477.
A remote attacker could execute arbitrary code on the database server
through a crafted STRALGO LCS command.
https://github.com/redis/redis/security/advisories/GHSA-46cp-x4x9-6pfq
https://github.com/redis/redis/pull/9011
https://github.com/redis/redis/pull/9019
https://github.com/redis/redis/commit/e9a1438ac4c52aa68dfa2a8324b6419356842116
https://security.archlinux.org/CVE-2021-32625
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
88.7%