Corrective releases for Redis DBMS versions 6.2.6, 6.0.16, and 5.0.14 have been published, fixing 8 vulnerabilities. All users are strongly advised to upgrade Redis to the new versions immediately.
- Four vulnerabilities (CVE-2021-41099, CVE-2021-32687, CVE-2021-32628, CVE-2021-32627) may lead to a buffer overflow when processing specially crafted commands and network requests, but exploitation requires specific configuration parameters (proto-max-bulk-len, set-max-intset-entries, hash-max-ziplist-*, proto-max-bulk-len, client-query-buffer-limit) to be set to very large values.
- The vulnerability CVE-2021-32762 may lead to a buffer overflow in redis-cli and redis-sentinel when parsing large responses on older platforms.
- The vulnerability CVE-2021-32675 may lead to denial of service when handling intense RESP requests with a large number of elements.
- The vulnerability CVE-2021-32672 may allow reading of memory contents through manipulation of the Lua Debugger.
- The vulnerability CVE-2021-32626 allows for a buffer overflow when executing specially crafted Lua scripts.
Source: opennet.ru
