CVE-2021-29478 Vulnerability in the COPY command for large intsets

Redis is an open source BSD licensed, in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis 6.2 before 6.2.3 could be exploited to corrupt the heap and potentially result with remote code execution. Redis 6.0 and earlier are not directly...

CVE-2021-29478

CVE-2021-29478 is an integer overflow in Redis 6.2 before 6.2.3 (and related COPY intsets) that could allow remote code execution when an attacker uses large intsets. IBM advisories cite affected IBM Robotic Process Automation for Cloud Pak versions (21.0.1–21.0.7.5 and 23.0.0–23.0.6) with remedi...

CVE-2021-29477

Redis is an open source BSD licensed, in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer could be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. The...

CVE-2021-29477 Vulnerability in the STRALGO LCS command

Redis is an open source BSD licensed, in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer could be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. The...

CVE-2021-29477

Redis is an open source BSD licensed, in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer could be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. The...

CVE-2021-29477

Redis fixes CVE-2021-29477: an integer overflow in STRALGO LCS on Redis 6.0+ that could allow remote code execution by crafting a command sequence. Patched in Redis 6.2.3 and 6.0.13; subsequent advisories note fixes in 6.2.4 and 6.0.14. Workarounds include ACLs to block STRALGO LCS and, on 64-bit...

Regular Expression Denial of Service

Overview In redis before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. Patches The problem was fixed in commit 2d11b6d and was released in...

Redis Labs Redis 输入验证错误漏洞

Redis Labs Redis is an open source, network-enabled, memory-based, persistent logging, key-value Key-Value storage database written in ANSI C, with a multi-language API, from Redis Labs, Inc. An input validation error vulnerability exists in Redis, which is caused by a STRALGO LCS command integer...

FreeBSD : redis -- multiple vulnerabilities (1606b03b-ac57-11eb-9bdd-8c164567ca3c)

Redis project reports : Vulnerability in the STRALGO LCS command An integer overflow bug in Redis version 6.0 or newer could be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. Vulnerability in the COPY command for large intsets An...

Redis Labs Redis 输入验证错误漏洞

Redis Labs Redis is an open source, network-enabled, memory-based, persistent logging, key-value Key-Value storage database written in ANSI C, with a multi-language API, from Redis Labs. An input validation error vulnerability exists in Redis due to an integer overflow in the COPY command for lar...

redis -- multiple vulnerabilities

Redis project reports: Vulnerability in the STRALGO LCS command An integer overflow bug in Redis version 6.0 or newer could be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. Vulnerability in the COPY command for large intsets An...

Metasploit Wrap-Up

Operations shell Operations and management software make popular targets due to their users typically having elevated privileges across a network. Our own wvu contributed the VMware vRealize Operations vROps Manager SSRF RCE exploit module for the vulnerabilities discovered by security researcher...

Redis Extractor

This module connects to a Redis instance and retrieves keys and data stored. Module Options msf use auxiliary/gather/redisextractor msf auxiliaryredisextractor show actions ...actions... msf auxiliaryredisextractor set ACTION msf auxiliaryredisextractor show options ...show and set options... msf...

GHSA-35Q2-47Q7-3PC3 Node-Redis potential exponential regex in monitor mode

Impact When a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. Patches The problem was fixed in commit 2d11b6d and was released in version 3.1.1. References 1569...

1-of (>=1.0.0, <=1.0.1), 3klesmanager-common (>=2.0.0, <=2.0.1) +5783 more potentially affected by CVE-2021-29469 via redis (>=2.6.0-0, <=3.1.0)

redis NPM version =2.6.0-0, =1.0.0, =2.0.0, =0.0.12, =0.0.12, =3.10.1, =1.0.0, =0.7.0, =1.0.0, =1.0.2, =1.2.1, =2.0.0, =1.0.0, =1.0.0, =2.4.0 and more Source cves: CVE-2021-29469 Source advisory: OSV:GHSA-35Q2-47Q7-3PC3...

Node-Redis potential exponential regex in monitor mode

Impact When a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. Patches The problem was fixed in commit 2d11b6d and was released in version 3.1.1. References 1569...

Regular Expression Denial Of Service (ReDoS)

redis is vulnerable to regular expression denial of service. The vulnerability exists due to exponential backtracking on some strings when a client is in monitoring mode...

CVE-2021-29469

Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. The issue is patched in version 3.1.1...

CVE-2021-29469

Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. The issue is patched in version 3.1.1...

DEBIAN-CVE-2021-29469

Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. The issue is patched in version 3.1.1...