CVE-2021-29477
published 2021-05-04CVE-2021-29477: Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version…
PriorityP259high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
4.03%
89.3th percentile
Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer could be exploited using the `STRALGO LCS` command to corrupt the heap and potentially result with remote code execution. The problem is fixed in version 6.2.3 and 6.0.13. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the `STRALGO LCS` command.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | redis | < redis 5:6.0.14-1 (bookworm) | redis 5:6.0.14-1 (bookworm) |
| debian | redis | < redis 5:6.0.13-1 (bookworm) | redis 5:6.0.13-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| redis | redis | < 6.0.14 | 6.0.14 |
| redis | redis | — | — |
| redis | redis | >= 0 < 5:6.0.14-1 | 5:6.0.14-1 |
| redis | redis | >= 0 < 5:6.0.13-1 | 5:6.0.13-1 |
| redis | redis | >= 0 < 5:6.0.14-1 | 5:6.0.14-1 |
| redis | redis | >= 0 < 5:6.0.13-1 | 5:6.0.13-1 |
| redis | redis | >= 0 < 5:6.0.14-1 | 5:6.0.14-1 |
| redis | redis | >= 0 < 5:6.0.13-1 | 5:6.0.13-1 |
| redis | redis | >= 0 < 5:6.0.14-1 | 5:6.0.14-1 |
| redis | redis | >= 0 < 5:6.0.13-1 | 5:6.0.13-1 |
| redislabs | redis | >= 6.0.0 < 6.0.13 | 6.0.13 |
| redislabs | redis | >= 6.0.0 < 6.0.14 | 6.0.14 |
| redislabs | redis | >= 6.2.0 < 6.2.3 | 6.2.3 |
| redislabs | redis | >= 6.2.0 < 6.2.4 | 6.2.4 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor Redis command logs for use of the STRALGO LCS command, which is the specific attack vector for this integer overflow / heap corruption vulnerability. ↗
- →Restrict or alert on STRALGO LCS command usage via Redis ACL configuration as a detection/mitigation control. ↗
- ·The proto-max-bulk-len config parameter being >= 2GB is a prerequisite for exploitation on 64-bit systems with the CVE-2021-29477 partial fix applied (versions 6.2.3 or 6.0.13). Ensure this is set below 2GB (default is 512MB) as an additional mitigation. ↗
- ·Only Redis version 6.0 or newer is vulnerable; Redis 5.x (e.g., redis:5 on RHEL 8) is not affected. ↗
- ·CVE-2021-29477 fix in versions 6.2.3/6.0.13 was incomplete; the follow-on CVE-2021-32625 requires patching to 6.2.4/6.0.14 for full remediation, particularly on 32-bit systems. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
osv8.8HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
redis: Heap corruption via `STRALGO LCS` command (Incomplete fix for CVE-2021-29477)
vendor_redhat·2021-06-01·CVSS 7.5
CVE-2021-32625 [HIGH] CWE-190 redis: Heap corruption via `STRALGO LCS` command (Incomplete fix for CVE-2021-29477)
redis: Heap corruption via `STRALGO LCS` command (Incomplete fix for CVE-2021-29477)
Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer, could be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477. The problem is fixed in version 6.2.4 and 6.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the STRALGO LCS command. On 64 bit systems which have the fixes of CVE-2021-29477 (6.2.3 or 6.0.13), it is sufficient to make sure that the proto-max-bulk-len co
Red Hat
redis: Integer overflow via STRALGO LCS command
vendor_redhat·2021-05-04·CVSS 7.5
CVE-2021-29477 [HIGH] CWE-190 redis: Integer overflow via STRALGO LCS command
redis: Integer overflow via STRALGO LCS command
Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer could be exploited using the `STRALGO LCS` command to corrupt the heap and potentially result with remote code execution. The problem is fixed in version 6.2.3 and 6.0.13. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the `STRALGO LCS` command.
A flaw was found in redis. An integer overflow bug could be exploited to corrupt the heap and potentially result with remote code execution. The highest threat from this vulnerability is to data confidentiality and integrity a
Debian
CVE-2021-32625: redis - Redis is an open source (BSD licensed), in-memory data structure store, used as ...
vendor_debian·2021·CVSS 7.5
CVE-2021-32625 [HIGH] CVE-2021-32625: redis - Redis is an open source (BSD licensed), in-memory data structure store, used as ...
Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer, could be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477. The problem is fixed in version 6.2.4 and 6.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the STRALGO LCS command. On 64 bit systems which have the fixes of CVE-2021-29477 (6.2.3 or 6.0.13), it is sufficient to make sure that the proto-max-bulk-len config parameter is smaller than 2GB (default is 512MB).
Scope: local
bookworm: resolved
Debian
CVE-2021-29477: redis - Redis is an open source (BSD licensed), in-memory data structure store, used as ...
vendor_debian·2021·CVSS 7.5
CVE-2021-29477 [HIGH] CVE-2021-29477: redis - Redis is an open source (BSD licensed), in-memory data structure store, used as ...
Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer could be exploited using the `STRALGO LCS` command to corrupt the heap and potentially result with remote code execution. The problem is fixed in version 6.2.3 and 6.0.13. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the `STRALGO LCS` command.
Scope: local
bookworm: resolved (fixed in 5:6.0.13-1)
bullseye: resolved (fixed in 5:6.0.13-1)
forky: resolved (fixed in 5:6.0.13-1)
sid: resolved (fixed in 5:6.0.13-1)
trixie: resolved (fixed in 5:6.0.13-1)
OSV
CVE-2021-32625: Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker
osv·2021-06-02·CVSS 8.8
CVE-2021-32625 [HIGH] CVE-2021-32625: Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker
Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer, could be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477. The problem is fixed in version 6.2.4 and 6.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the STRALGO LCS command. On 64 bit systems which have the fixes of CVE-2021-29477 (6.2.3 or 6.0.13), it is sufficient to make sure that the proto-max-bulk-len config parameter is smaller than 2GB (default is 512MB).
OSV
CVE-2021-29477: Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker
osv·2021-05-04·CVSS 8.8
CVE-2021-29477 [HIGH] CVE-2021-29477: Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker
Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer could be exploited using the `STRALGO LCS` command to corrupt the heap and potentially result with remote code execution. The problem is fixed in version 6.2.3 and 6.0.13. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the `STRALGO LCS` command.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/redis/redis/security/advisories/GHSA-vqxj-26vj-996ghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BHWOF7CBVUGDK3AN6H3BN3VNTH2TDUZZ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPWBIZXA67JFIB63W2CNVVILCGIC2ME5/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZJ6JGQ2ETZB2DWTQSGCOGG7EF3ILV4V/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SN7INTZFE34MIQJO7WDDTIY5LIBGN6GI/https://redis.io/https://security.gentoo.org/glsa/202107-20https://github.com/redis/redis/security/advisories/GHSA-vqxj-26vj-996ghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BHWOF7CBVUGDK3AN6H3BN3VNTH2TDUZZ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPWBIZXA67JFIB63W2CNVVILCGIC2ME5/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZJ6JGQ2ETZB2DWTQSGCOGG7EF3ILV4V/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SN7INTZFE34MIQJO7WDDTIY5LIBGN6GI/https://redis.io/https://security.gentoo.org/glsa/202107-20
2021-05-04
Published