Bugzilla – Bug 1185729
VUL-0: CVE-2021-29477: redis: Integer overflow via STRALGO LCS command
Last modified: 2023-01-25 19:16:42 UTC
CVE-2021-29477 Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer could be exploited using the `STRALGO LCS` command to corrupt the heap and potentially result with remote code execution. The problem is fixed in version 6.2.3 and 6.0.13. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the `STRALGO LCS` command. References: https://redis.io/ https://github.com/redis/redis/security/advisories/GHSA-vqxj-26vj-996g References: https://bugzilla.redhat.com/show_bug.cgi?id=1957410 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-29477 https://github.com/redis/redis/security/advisories/GHSA-vqxj-26vj-996g http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29477 https://redis.io/
Affected versions: <6.2.3, <6.0.13 Fixed versions: 6.2.3, 6.0.13 Affected packages: - SUSE:SLE-15:Update/redis 6.0.10 - openSUSE:Factory/redis 6.2.2 Upstream patch can be found here [0]. [0] https://github.com/redis/redis/commit/f0c5f920d0f88bd8aa376a2c05af4902789d1ef9.patch
This is an autogenerated message for OBS integration: This bug (1185729) was mentioned in https://build.opensuse.org/request/show/891113 15.2 / redis
openSUSE-SU-2021:0682-1: An update that solves three vulnerabilities, contains 8 features and has one errata is now available. Category: security (important) Bug References: 1178205,1182657,1185729,1185730 CVE References: CVE-2021-21309,CVE-2021-29477,CVE-2021-29478 JIRA References: ECO-2417,ECO-2867,PM-1547,PM-1615,PM-1622,PM-1681,SLE-11578,SLE-12821 Sources used: openSUSE Leap 15.2 (src): redis-6.0.13-lp152.2.3.1
https://build.suse.de/request/show/240895
SUSE-SU-2021:1652-1: An update that fixes three vulnerabilities is now available. Category: security (important) Bug References: 1182657,1185729,1185730 CVE References: CVE-2021-21309,CVE-2021-29477,CVE-2021-29478 JIRA References: Sources used: SUSE Linux Enterprise Module for Server Applications 15-SP3 (src): redis-6.0.13-1.10.1 SUSE Linux Enterprise Module for Server Applications 15-SP2 (src): redis-6.0.13-1.10.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Done, closing.