NVD Vulnerability Detail

CVE-2021-29477

Summary	Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer could be exploited using the `STRALGO LCS` command to corrupt the heap and potentially result with remote code execution. The problem is fixed in version 6.2.3 and 6.0.13. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the `STRALGO LCS` command.
Publication Date	May 5, 2021, 1:15 a.m.
Registration Date	May 5, 2021, 10:02 a.m.
Last Update	Nov. 21, 2024, 3:01 p.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	https://github.com/redis/redis/security/advisories/GHSA-vqxj-26vj-996g	Third Party Advisory
2	https://github.com/redis/redis/security/advisories/GHSA-vqxj-26vj-996g	Third Party Advisory
3	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BHWOF7CBVUGDK3AN6H3BN3VNTH2TDUZZ/
4	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BHWOF7CBVUGDK3AN6H3BN3VNTH2TDUZZ/
5	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPWBIZXA67JFIB63W2CNVVILCGIC2ME5/
6	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPWBIZXA67JFIB63W2CNVVILCGIC2ME5/
7	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZJ6JGQ2ETZB2DWTQSGCOGG7EF3ILV4V/
8	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZJ6JGQ2ETZB2DWTQSGCOGG7EF3ILV4V/
9	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SN7INTZFE34MIQJO7WDDTIY5LIBGN6GI/
10	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SN7INTZFE34MIQJO7WDDTIY5LIBGN6GI/
11	https://redis.io/	Product
12	https://redis.io/	Product
13	https://security.gentoo.org/glsa/202107-20	Third Party Advisory
14	https://security.gentoo.org/glsa/202107-20	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-190	整数オーバーフローまたはラップアラウンド	https://cwe.mitre.org/data/definitions/190.html

JVN Vulnerability Information

Redis における整数オーバーフローの脆弱性

Title	Redis における整数オーバーフローの脆弱性
Summary	Redis には、整数オーバーフローの脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	May 4, 2021, midnight
Registration Date	Jan. 17, 2022, 5:32 p.m.
Last Update	Jan. 17, 2022, 5:32 p.m.

Affected System

Redis

Redis 6.0.13 未満

Redis 6.2.3 未満

Fedora Project

Fedora

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-29477	https://www.cve.org/CVERecord?id=CVE-2021-29477
National Vulnerability Database (NVD)
2	CVE-2021-29477	https://nvd.nist.gov/vuln/detail/CVE-2021-29477

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-190	https://cwe.mitre.org/data/definitions/190.html

ベンダー情報

No	Name	URL
Fedora Update Notification
1	FEDORA-2021-3b267a756c	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZJ6JGQ2ETZB2DWTQSGCOGG7EF3ILV4V/
2	FEDORA-2021-8b19c99d6a	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BPWBIZXA67JFIB63W2CNVVILCGIC2ME5/
GitHub
3	Vulnerability in the STRALGO LCS command	https://github.com/redis/redis/security/advisories/GHSA-vqxj-26vj-996g
Redis
4	Top Page	https://redis.io/

Change Log

No	Changed Details	Date of change
1	[2022年01月17日] 掲載	Jan. 17, 2022, 5:32 p.m.