NVD Vulnerability Detail

CVE-2021-32625

Summary	Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer, could be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477. The problem is fixed in version 6.2.4 and 6.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the STRALGO LCS command. On 64 bit systems which have the fixes of CVE-2021-29477 (6.2.3 or 6.0.13), it is sufficient to make sure that the proto-max-bulk-len config parameter is smaller than 2GB (default is 512MB).
Publication Date	June 3, 2021, 5:15 a.m.
Registration Date	June 3, 2021, 10 a.m.
Last Update	Nov. 21, 2024, 3:07 p.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	https://github.com/redis/redis/releases/tag/6.0.14	Release Notes Third Party Advisory
2	https://github.com/redis/redis/releases/tag/6.0.14	Release Notes Third Party Advisory
3	https://github.com/redis/redis/releases/tag/6.2.4	Release Notes Third Party Advisory
4	https://github.com/redis/redis/releases/tag/6.2.4	Release Notes Third Party Advisory
5	https://github.com/redis/redis/security/advisories/GHSA-46cp-x4x9-6pfq	Third Party Advisory
6	https://github.com/redis/redis/security/advisories/GHSA-46cp-x4x9-6pfq	Third Party Advisory
7	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BHWOF7CBVUGDK3AN6H3BN3VNTH2TDUZZ/
8	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BHWOF7CBVUGDK3AN6H3BN3VNTH2TDUZZ/
9	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SN7INTZFE34MIQJO7WDDTIY5LIBGN6GI/
10	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SN7INTZFE34MIQJO7WDDTIY5LIBGN6GI/

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-190	整数オーバーフローまたはラップアラウンド	https://cwe.mitre.org/data/definitions/190.html

JVN Vulnerability Information

Redis における古典的バッファオーバーフローの脆弱性

Title	Redis における古典的バッファオーバーフローの脆弱性
Summary	Redis には、古典的バッファオーバーフローの脆弱性が存在します。本脆弱性は、CVE-2021-29477 に対する修正が不完全だったことに起因する脆弱性です。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	June 1, 2021, midnight
Registration Date	Feb. 22, 2022, 5:53 p.m.
Last Update	Feb. 22, 2022, 5:53 p.m.

Affected System

Redis

Redis 6.0.14 未満

Redis 6.2.4 未満

Fedora Project

Fedora

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-32625	https://www.cve.org/CVERecord?id=CVE-2021-32625
National Vulnerability Database (NVD)
2	CVE-2021-32625	https://nvd.nist.gov/vuln/detail/CVE-2021-32625

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-120	https://cwe.mitre.org/data/definitions/120.html

ベンダー情報

No	Name	URL
Fedora Update Notification
1	FEDORA-2021-0ad4bec5b1	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SN7INTZFE34MIQJO7WDDTIY5LIBGN6GI/
2	FEDORA-2021-916f861096	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BHWOF7CBVUGDK3AN6H3BN3VNTH2TDUZZ/
GitHub
3	6.0.14	https://github.com/redis/redis/releases/tag/6.0.14
4	6.2.4	https://github.com/redis/redis/releases/tag/6.2.4
5	Vulnerability in STRALGO LCS	https://github.com/redis/redis/security/advisories/GHSA-46cp-x4x9-6pfq

Change Log

No	Changed Details	Date of change
1	[2022年02月22日] 掲載	Feb. 22, 2022, 5:53 p.m.