Lucene search

K
nvd[email protected]NVD:CVE-2021-32762
HistoryOct 04, 2021 - 6:15 p.m.

CVE-2021-32762

2021-10-0418:15:09
CWE-680
CWE-190
web.nvd.nist.gov
8
redis
integer overflow
network replies
security vulnerability
heap allocation

CVSS2

9

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.009

Percentile

83.2%

Redis is an open source, in-memory database that persists on disk. The redis-cli command line tool and redis-sentinel service may be vulnerable to integer overflow when parsing specially crafted large multi-bulk network replies. This is a result of a vulnerability in the underlying hiredis library which does not perform an overflow check before calling the calloc() heap allocation function. This issue only impacts systems with heap allocators that do not perform their own overflow checks. Most modern systems do and are therefore not likely to be affected. Furthermore, by default redis-sentinel uses the jemalloc allocator which is also not vulnerable. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14.

Affected configurations

Nvd
Node
redisredisRange5.0.05.0.14
OR
redisredisRange6.0.06.0.16
OR
redisredisRange6.2.06.2.6
Node
debiandebian_linuxMatch10.0
OR
debiandebian_linuxMatch11.0
Node
fedoraprojectfedoraMatch33
OR
fedoraprojectfedoraMatch34
OR
fedoraprojectfedoraMatch35
Node
netappmanagement_services_for_element_softwareMatch-
OR
netappmanagement_services_for_netapp_hciMatch-
Node
oraclecommunications_operations_monitorMatch4.3
OR
oraclecommunications_operations_monitorMatch4.4
OR
oraclecommunications_operations_monitorMatch5.0
VendorProductVersionCPE
redisredis*cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*
debiandebian_linux10.0cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
debiandebian_linux11.0cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
fedoraprojectfedora33cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
fedoraprojectfedora34cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
fedoraprojectfedora35cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
netappmanagement_services_for_element_software-cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*
netappmanagement_services_for_netapp_hci-cpe:2.3:a:netapp:management_services_for_netapp_hci:-:*:*:*:*:*:*:*
oraclecommunications_operations_monitor4.3cpe:2.3:a:oracle:communications_operations_monitor:4.3:*:*:*:*:*:*:*
oraclecommunications_operations_monitor4.4cpe:2.3:a:oracle:communications_operations_monitor:4.4:*:*:*:*:*:*:*
Rows per page:
1-10 of 111

CVSS2

9

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.009

Percentile

83.2%