Most recent entries from all

ALSA-2025:0595 — Important: redis:6 security update

Affected: AlmaLinux:8: redis, AlmaLinux:8: redis-devel, AlmaLinux:8: redis-doc

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.

Security Fix(es):

* redis: Integer overflow in the Redis HRANDFIELD and ZRANDMEMBER commands may lead to denial-of-service (CVE-2023-22458) * redis: Integer overflow in the Redis SETRANGE and SORT/SORT_RO commands may result with false OOM panic (CVE-2022-35977) * redis: Specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD commands can trigger an integer overflow (CVE-2022-36021) * redis: String matching commands (like SCAN or KEYS) with a specially crafted pattern to trigger a denial-of-service attack (CVE-2023-25155) * redis: Insufficient validation of HINCRBYFLOAT command (CVE-2023-28856) * redis: heap overflow in the lua cjson and cmsgpack libraries (CVE-2022-24834) * redis: possible bypass of Unix socket permissions on startup (CVE-2023-45145) * redis: Lua library commands may lead to stack overflow and RCE in Redis (CVE-2024-31449) * redis: Denial-of-service due to unbounded pattern matching in Redis (CVE-2024-31228) * redis: Redis' Lua library commands may lead to remote code execution (CVE-2024-46981)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and o…

bdu:2023-01308

Withdrawn: BELL-CVE-2022-36021 — CVE-2022-36021 does not affect BellSoft software

Withdrawn by the publisher.

BIT-keydb-2022-36021 — Redis string pattern matching can be abused to achieve Denial of Service

Affected: Bitnami: keydb

Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. The problem is fixed in Redis versions 6.0.18, 6.2.11, 7.0.9.

certfr-2024-avi-0119 — De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entr…

certfr-2024-avi-0119

EUVD-2026-221395

fkie_cve-2022-36021

gsd-2022-36021

ICSA-24-046-11 — Siemens SCALANCE XCM-/XRM-300

A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash.

This issue affects Apache HTTP Server 2.4.54 and earlier. A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability. A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. This flaw allows an attacker to achieve code execution if they can alter the header information of an RPM package and then trick a user or system into installing it. The highest risk of this vulnerability is to confidentiality, integrity, as well as system availability. An out-of-bounds memory access flaw was found in the ATI VGA device emulation of QEMU. This flaw occurs in the ati_2d_blt() routine while handling MMIO write operations when the guest provides invalid values for the destination display parameters. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service. A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create…

msrc_CVE-2022-36021 — Redis string pattern matching can be abused to achieve Denial of Service

msrc_CVE-2022-36021

OESA-2023-1184 — redis security update

Affected: openEuler:20.03-LTS-SP1: redis, openEuler:20.03-LTS-SP3: redis, openEuler:22.03-LTS: redis, openEuler:22.03-LTS-SP1: redis

Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets. Security Fix(es): Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. The problem is fixed in Redis versions 6.0.18, 6.2.11, 7.0.9.(CVE-2022-36021)

openSUSE-SU-2024:12743-1 — redis-7.0.8-2.1 on GA media

redis-7.0.8-2.1 on GA media

SUSE-SU-2023:0693-1 — Security update for redis

Security update for redis

UBUNTU-CVE-2022-36021

Affected: Ubuntu:Pro:14.04:LTS: redis, Ubuntu:Pro:16.04:LTS: redis, Ubuntu:Pro:18.04:LTS: redis, Ubuntu:Pro:20.04:LTS: redis, Ubuntu:Pro:22.04:LTS: redis

WID-SEC-W-2023-0510 — Redis: Mehrere Schwachstellen ermöglichen Denial of Service

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Redis ausnutzen, um einen Denial of Service Angriff durchzuführen.