Debian Security Advisory
DLA-2810-1 redis -- LTS security update
- Date Reported:
- 05 Nov 2021
- Affected Packages:
- Security database references:
- In Mitre's CVE dictionary: CVE-2021-41099, CVE-2021-32762, CVE-2021-32687, CVE-2021-32675, CVE-2021-32672, CVE-2021-32626.
- More information:
It was discovered that there were a number of issues in redis, a popular key-value database system:
- CVE-2021-41099: Integer to heap buffer overflow handling certain string commands and network payloads, when proto-max-bulk-len is manually configured to a non-default, very large value.
- CVE-2021-32762: Integer to heap buffer overflow issue in redis-cli and redis-sentinel parsing large multi-bulk replies on some older and less common platforms.
- CVE-2021-32687: Integer to heap buffer overflow with intsets, when set-max-intset-entries is manually configured to a non-default, very large value.
- CVE-2021-32675: Denial Of Service when processing RESP request payloads with a large number of elements on many connections.
- CVE-2021-32672: Random heap reading issue with Lua Debugger.
- CVE-2021-32626: Specially crafted Lua scripts may result with Heap buffer overflow.
For Debian 9
Stretch, these problems have been fixed in version 3:3.2.6-3+deb9u8.
We recommend that you upgrade your redis packages.
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS