ArchLinux: 202106-12: redis: arbitrary code execution | LinuxSecuri...

Advisories

Arch Linux Security Advisory ASA-202106-12
==========================================

Severity: High
Date    : 2021-06-01
CVE-ID  : CVE-2021-32625
Package : redis
Type    : arbitrary code execution
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2022

Summary
=======

The package redis before version 6.2.4-1 is vulnerable to arbitrary
code execution.

Resolution
==========

Upgrade to 6.2.4-1.

# pacman -Syu "redis>=6.2.4-1"

The problem has been fixed upstream in version 6.2.4.

Workaround
==========

A workaround to mitigate the problem is to use an ACL configuration to
prevent clients from using the STRALGO LCS command.

On systems running Redis version 6.2.3, it is sufficient to make sure
that the proto-max-bulk-len config parameter is smaller than 2GB
(default is 512MB).

Description
===========

An integer overflow bug in Redis versions 6.0 up to 6.2.3 can be
exploited using the STRALGO LCS command to corrupt the heap and
potentially result in remote code execution. This is a result of an
incomplete fix of CVE-2021-29477.

Impact
======

A remote attacker could execute arbitrary code on the database server
through a crafted STRALGO LCS command.

References
==========

https://github.com/redis/redis/security/advisories/GHSA-46cp-x4x9-6pfq
https://github.com/redis/redis/pull/9011
https://github.com/redis/redis/pull/9019
https://github.com/redis/redis/commit/e9a1438ac4c52aa68dfa2a8324b6419356842116
https://security.archlinux.org/CVE-2021-32625

ArchLinux: 202106-12: redis: arbitrary code execution

June 3, 2021
The package redis before version 6.2.4-1 is vulnerable to arbitrary code execution

Summary

An integer overflow bug in Redis versions 6.0 up to 6.2.3 can be exploited using the STRALGO LCS command to corrupt the heap and potentially result in remote code execution. This is a result of an incomplete fix of CVE-2021-29477.

Resolution

Upgrade to 6.2.4-1.
# pacman -Syu "redis>=6.2.4-1"
The problem has been fixed upstream in version 6.2.4.

References

https://github.com/redis/redis/security/advisories/GHSA-46cp-x4x9-6pfq https://github.com/redis/redis/pull/9011 https://github.com/redis/redis/pull/9019 https://github.com/redis/redis/commit/e9a1438ac4c52aa68dfa2a8324b6419356842116 https://security.archlinux.org/CVE-2021-32625

Severity
CVE-ID : CVE-2021-32625
Package : redis
Type : arbitrary code execution
Remote : Yes
Link : https://security.archlinux.org/AVG-2022

Impact

A remote attacker could execute arbitrary code on the database server through a crafted STRALGO LCS command.

Workaround

A workaround to mitigate the problem is to use an ACL configuration toprevent clients from using the STRALGO LCS command.On systems running Redis version 6.2.3, it is sufficient to make surethat the proto-max-bulk-len config parameter is smaller than 2GB(default is 512MB).

Related News

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.