[SECURITY] [DLA 2810-1] redis security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2810-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Chris Lamb
November 05, 2021 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : redis
Version : 3:3.2.6-3+deb9u8
CVE IDs : CVE-2021-41099 CVE-2021-32762 CVE-2021-32687
CVE-2021-32675 CVE-2021-32672 CVE-2021-32626
It was discovered that there were a number of issues in redis, a
popular key-value database system:
* CVE-2021-41099: Integer to heap buffer overflow handling certain
string commands and network payloads, when proto-max-bulk-len is
manually configured to a non-default, very large value.
* CVE-2021-32762: Integer to heap buffer overflow issue in redis-cli
and redis-sentinel parsing large multi-bulk replies on some older
and less common platforms.
* CVE-2021-32687: Integer to heap buffer overflow with intsets, when
set-max-intset-entries is manually configured to a non-default,
very large value.
* CVE-2021-32675: Denial Of Service when processing RESP request
payloads with a large number of elements on many connections.
* CVE-2021-32672: Random heap reading issue with Lua Debugger.
* CVE-2021-32626: Specially crafted Lua scripts may result with
Heap buffer overflow.
For Debian 9 "Stretch", this problem has been fixed in version
3:3.2.6-3+deb9u8.
We recommend that you upgrade your redis packages.
For the detailed security status of redis please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/redis
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmGFEBwACgkQHpU+J9Qx
HljFAg/8CbV6z+azeXQ+OcQ4Osv49BvTiqC6x8LfXkrmKD6bBq2PE0X7Oz8pyp61
3aYIH2sluZi9VK31uThjLFtAt9QFDezxTQhfQPTxjHi68YQ3eA0ePaaY/MIJdp7+
s9W2HRd33dsvG3UA9+JsErJ+BESTd0zu2FmUkVGt/rqH+CYbeTC+OlEeHxMqsVqW
1vAbUTs1zVESSvZ1/A5bknrlb9rTIHq//80EekKsP/HKsW3EDt5R7pIGgoW2xJkv
HCdqaMCnoh7TdbkE2wZxydgE1xMeHcQtti9CEFKQsjaa/q1b3HJLfvRZRx3cZ396
6ZoccESE5zNi13ojpnKOCUGapH9sPsJULk/wLWplNkDBnk356kCoLurYCb3F/EXF
oHeWG2UMNZcIAx2gwbwmxL1YZeQFawOSuOsbuufcQKqcwXIO70OhRGJgnlij0iKl
1Y2NZJbgV3keoUj6b4uU+sAOm3mud/xw25I7Q2r9rfW02RF0hhaVJZlYgSOzKby1
SDkO0rX2u6Ks4LuSqEkzhOXo9+JunvYAAODyanHdTk3rsG3oFgblfSUErvv9Vb/N
31wZdIrwn3CnvyokC042CByiXpoxfI+UFiDJUFsuWpaB4qFOEZW/DqM0QLlzHbwg
olpAt2vkf80yXOM3Zi5qex7veZw5RPEnx+JLu0HKxCT2kmCY9rA=
=O7GA
-----END PGP SIGNATURE-----
Reply to: