Debian Security Advisory

DLA-2810-1 redis -- LTS security update

Date Reported:
05 Nov 2021
Affected Packages:
redis
Vulnerable:
Yes
Security database references:
In Mitre's CVE dictionary: CVE-2021-41099, CVE-2021-32762, CVE-2021-32687, CVE-2021-32675, CVE-2021-32672, CVE-2021-32626.
More information:

It was discovered that there were a number of issues in redis, a popular key-value database system:

  • CVE-2021-41099: Integer to heap buffer overflow handling certain string commands and network payloads, when proto-max-bulk-len is manually configured to a non-default, very large value.
  • CVE-2021-32762: Integer to heap buffer overflow issue in redis-cli and redis-sentinel parsing large multi-bulk replies on some older and less common platforms.
  • CVE-2021-32687: Integer to heap buffer overflow with intsets, when set-max-intset-entries is manually configured to a non-default, very large value.
  • CVE-2021-32675: Denial Of Service when processing RESP request payloads with a large number of elements on many connections.
  • CVE-2021-32672: Random heap reading issue with Lua Debugger.
  • CVE-2021-32626: Specially crafted Lua scripts may result with Heap buffer overflow.

For Debian 9 Stretch, these problems have been fixed in version 3:3.2.6-3+deb9u8.

We recommend that you upgrade your redis packages.

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS