Most recent entries from all

ALSA-2021:3918 — Important: redis:5 security update

Affected: AlmaLinux:8: redis, AlmaLinux:8: redis-devel, AlmaLinux:8: redis-doc

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.

Security Fix(es):

* redis: Lua scripts can overflow the heap-based Lua stack (CVE-2021-32626)

* redis: Integer overflow issue with Streams (CVE-2021-32627)

* redis: Integer overflow bug in the ziplist data structure (CVE-2021-32628)

* redis: Denial of service via Redis Standard Protocol (RESP) request (CVE-2021-32675)

* redis: Integer overflow issue with intsets (CVE-2021-32687)

* redis: Integer overflow issue with strings (CVE-2021-41099)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2021-05031

Withdrawn: BELL-CVE-2021-32626 — CVE-2021-32626 does not affect BellSoft software

Withdrawn by the publisher.

BIT-keydb-2021-32626 — Lua scripts can overflow the heap-based Lua stack in Redis

Affected: Bitnami: keydb

Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can cause the heap-based Lua stack to be overflowed, due to incomplete checks for this condition. This can result with heap corruption and potentially remote code execution. This problem exists in all versions of Redis with Lua scripting support, starting from 2.6. The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14. For users unable to update an additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

certfr-2021-avi-848 — De multiples vulnérabilités ont été découvertes dans les produits NetApp. Elles permettent à un attaquant de provoquer…

certfr-2021-avi-848

Withdrawn: CLEANSTART-2026-AF35851 — Redis is an open source, in-memory database that persists on disk

Withdrawn by the publisher.

Affected: CleanStart: redis

Multiple security vulnerabilities affect the redis package. Redis is an open source, in-memory database that persists on disk. See references for individual vulnerability details.

EUVD-2026-28020

fkie_cve-2021-32626

gsd-2021-32626

msrc_CVE-2021-32626 — Lua scripts can overflow the heap-based Lua stack in Redis

msrc_CVE-2021-32626

OESA-2021-1432 — redis6 security update

Affected: openEuler:20.03-LTS-SP1: redis6, openEuler:20.03-LTS-SP2: redis6

Redis is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. Security Fix(es): Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can cause the heap-based Lua stack to be overflowed, due to incomplete checks for this condition. This can result with heap corruption and potentially remote code execution. This problem exists in all versions of Redis with Lua scripting support, starting from 2.6. The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14. For users unable to update an additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.(CVE-2021-32626)

openSUSE-SU-2021:3772-1 — Security update for redis

Security update for redis

RHSA-2021:3873 — Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.2.9 security, bug, and container updates

semver-regex: inefficient regular expression complexity nginx: Off-by-one in ngx_resolver_copy() when labels are followed by a pointer to a root domain name object-path: Type confusion vulnerability can lead to a bypass of CVE-2020-15256 nodejs-set-value: type confusion allows bypass of CVE-2019-10747 redis: Lua scripts can overflow the heap-based Lua stack redis: Integer overflow issue with Streams redis: Integer overflow bug in the ziplist data structure redis: Out of bounds read in lua debugger protocol parser redis: Denial of service via Redis Standard Protocol (RESP) request redis: Integer overflow issue with intsets redis: Integer overflow issue with strings

SUSE-SU-2021:3772-1 — Security update for redis

Security update for redis

UBUNTU-CVE-2021-32626

Affected: Ubuntu:Pro:14.04:LTS: redis, Ubuntu:Pro:16.04:LTS: redis, Ubuntu:Pro:18.04:LTS: redis, Ubuntu:Pro:20.04:LTS: redis

WID-SEC-W-2022-1579 — Redis: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Redis ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.