PT-2021-2994 · Redis+1 · Redis+1
Oranagrapu
·
Published
2021-05-04
·
Updated
2024-06-15
·
CVE-2021-29478
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Redis versions 6.2.0 through 6.2.2
Description
The issue is related to an integer overflow bug that could be exploited to corrupt the heap and potentially result in remote code execution. This can be achieved by modifying the
set-max-intset-entries configuration parameter. The problem can be mitigated by preventing users from modifying this parameter using ACL to restrict unprivileged users from using the CONFIG SET command.Recommendations
For Redis versions 6.2.0 through 6.2.2, update to version 6.2.3 to resolve the issue.
As a temporary workaround, consider restricting access to the
set-max-intset-entries configuration parameter by using ACL to prevent unprivileged users from using the CONFIG SET command.Fix
RCE
Memory Corruption
Integer Overflow
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Redis
Suse