Denial Of Service (DoS)

2023-01-2208:13:05

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

redis

dos

vulnerability

integer overflow

memory allocation

oom panic

authenticated users

setrange

sort

commands

0.0004 Low

EPSS

Percentile

14.2%

JSON

redis is vulnerable to Denial of Service(DoS) attacks. Authenticated users issuing specially crafted SETRANGE and SORT(_RO) commands can trigger an integer overflow, resulting with the library attempting to allocate impossible amounts of memory and abort with an out-of-memory (OOM) panic.

CPENameOperatorVersion
redis:edgeeq6.2.4-r0
redis:edgeeq6.2.3-r0
redis:edgeeq7.0.4-r1
redis:edgeeq6.2.5-r0
redis:edgeeq6.2.1-r0
redis:edgeeq6.2.6-r0
redis:edgeeq7.0.2-r0
redis:edgeeq5.0.7-r0
redis:edgeeq5.0.8-r0
redis:edgeeq7.0.5-r0

Name	Operator	Version
redis:edge	eq	6.2.4-r0
redis:edge	eq	6.2.3-r0
redis:edge	eq	7.0.4-r1
redis:edge	eq	6.2.5-r0
redis:edge	eq	6.2.1-r0
redis:edge	eq	6.2.6-r0
redis:edge	eq	7.0.2-r0
redis:edge	eq	5.0.7-r0
redis:edge	eq	5.0.8-r0
redis:edge	eq	7.0.5-r0