cbcvebase.
CVE-2021-32628
published 2021-10-04

CVE-2021-32628: Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the ziplist data structure used by all versions of Redis can be…

PriorityP359high7.5CVSS 3.1
AVNACHPRLUINSUCHIHAH
EPSS
12.62%
95.8th percentile
Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the ziplist data structure used by all versions of Redis can be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves modifying the default ziplist configuration parameters (hash-max-ziplist-entries, hash-max-ziplist-value, zset-max-ziplist-entries or zset-max-ziplist-value) to a very large value, and then constructing specially crafted commands to create very large ziplists. The problem is fixed in Redis versions 6.2.6, 6.0.16, 5.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the above configuration parameters. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.

Affected

25 ranges
VendorProductVersion rangeFixed in
debiandebian_linux
debiandebian_linux
debianredis< redis 5:6.0.16-1 (bookworm)redis 5:6.0.16-1 (bookworm)
fedoraprojectfedora
fedoraprojectfedora
fedoraprojectfedora
msrccbl2_redis_6.2.6-1_on_cbl_mariner_2.0
msrccm1_redis_5.0.14-1_on_cbl_mariner_1.0
oraclecommunications_operations_monitor
oraclecommunications_operations_monitor
oraclecommunications_operations_monitor
redisredis< 5.0.145.0.14
redisredis
redisredis
redisredis>= 0 < 5:6.0.16-1+deb11u15:6.0.16-1+deb11u1
redisredis>= 0 < 5:6.0.16-15:6.0.16-1
redisredis>= 0 < 5:6.0.16-15:6.0.16-1
redisredis>= 0 < 5:6.0.16-15:6.0.16-1
redisredis>= 0 < 2:2.8.4-2ubuntu0.2+esm22:2.8.4-2ubuntu0.2+esm2
redisredis>= 0 < 2:3.0.6-1ubuntu0.4+esm12:3.0.6-1ubuntu0.4+esm1
redisredis>= 0 < 5:4.0.9-1ubuntu0.2+esm35:4.0.9-1ubuntu0.2+esm3
redisredis>= 0 < 5:5.0.7-2ubuntu0.1+esm15:5.0.7-2ubuntu0.1+esm1
redisredis>= 5.0.0 < 5.0.145.0.14
redisredis>= 6.0.0 < 6.0.166.0.16
redisredis>= 6.2.0 < 6.2.66.2.6

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.0MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
osv8.8HIGH
vendor_debian7.5HIGH
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu5.4MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.