[SECURITY] [DLA 2810-1] redis security update

Debian LTS Advisory DLA-2810-1 [email protected]
https://www.debian.org/lts/security/ Chris Lamb
November 05, 2021 https://wiki.debian.org/LTS

Package : redis
Version : 3:3.2.6-3+deb9u8
CVE IDs : CVE-2021-41099 CVE-2021-32762 CVE-2021-32687
CVE-2021-32675 CVE-2021-32672 CVE-2021-32626

It was discovered that there were a number of issues in redis, a
popular key-value database system:

• CVE-2021-41099: Integer to heap buffer overflow handling certain
  string commands and network payloads, when proto-max-bulk-len is
  manually configured to a non-default, very large value.

• CVE-2021-32762: Integer to heap buffer overflow issue in redis-cli
  and redis-sentinel parsing large multi-bulk replies on some older
  and less common platforms.

• CVE-2021-32687: Integer to heap buffer overflow with intsets, when
  set-max-intset-entries is manually configured to a non-default,
  very large value.

• CVE-2021-32675: Denial Of Service when processing RESP request
  payloads with a large number of elements on many connections.

• CVE-2021-32672: Random heap reading issue with Lua Debugger.

• CVE-2021-32626: Specially crafted Lua scripts may result with
  Heap buffer overflow.

For Debian 9 "Stretch", this problem has been fixed in version
3:3.2.6-3+deb9u8.

We recommend that you upgrade your redis packages.

For the detailed security status of redis please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/redis

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS