From d4165282fca217d6969d7e901c112b53f2dcbc59 Mon Sep 17 00:00:00 2001 From: Yasuhiro Kimura Date: Tue, 4 May 2021 05:58:18 +0900 Subject: [PATCH] security/vuxml: Document multiple vulnerabilities in redis Document multiple vulnerabilities in redis (CVE-2021-29477, CVE-2021-29478). --- security/vuxml/vuln.xml | 49 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index da24c21cf97a..c61641d58327 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -76,6 +76,55 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + redis -- Multiple vulnerabilities + + + redis + 6.0.06.0.13 + + + redis-devel + 6.2.06.2.3 + + + + +

Redis project reports:

+
+
+
Vulnerability in the STRALGO LCS command
+
+ An integer overflow bug in Redis version 6.0 or newer could be + exploited using the STRALGO LCS command to corrupt the heap and + potentially result with remote code execution. +
+
Vulnerability in the COPY command for large intsets
+
+ An integer overflow bug in Redis 6.2 could be exploited to corrupt + the heap and potentially result with remote code execution. + The vulnerability involves changing the default set-max-intset-entries + configuration value, creating a large set key that consists of + integer values and using the COPY command to duplicate it. + The integer overflow bug exists in all versions of Redis starting + with 2.6, where it could result with a corrupted RDB or DUMP payload, + but not exploited through COPY (which did not exist before 6.2). +
+
+
+ + + + CVE-2021-29477 + CVE-2021-29478 + https://groups.google.com/g/redis-db/c/6GSWzTW0PR8 + + + 2021-05-03 + 2021-05-03 + + + sympa -- Unauthorised full access via SOAP API due to illegal cookie -- 2.31.1