CVE-2021-29477

Redis fixes CVE-2021-29477: an integer overflow in STRALGO LCS on Redis 6.0+ that could allow remote code execution by crafting a command sequence. Patched in Redis 6.2.3 and 6.0.13; subsequent advisories note fixes in 6.2.4 and 6.0.14. Workarounds include ACLs to block STRALGO LCS and, on 64-bit...

Regular Expression Denial of Service

Overview In redis before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. Patches The problem was fixed in commit 2d11b6d and was released in...

Redis Labs Redis 输入验证错误漏洞

Redis Labs Redis is an open source, network-enabled, memory-based, persistent logging, key-value Key-Value storage database written in ANSI C, with a multi-language API, from Redis Labs, Inc. An input validation error vulnerability exists in Redis, which is caused by a STRALGO LCS command integer...

FreeBSD : redis -- multiple vulnerabilities (1606b03b-ac57-11eb-9bdd-8c164567ca3c)

Redis project reports : Vulnerability in the STRALGO LCS command An integer overflow bug in Redis version 6.0 or newer could be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. Vulnerability in the COPY command for large intsets An...

Redis Labs Redis 输入验证错误漏洞

Redis Labs Redis is an open source, network-enabled, memory-based, persistent logging, key-value Key-Value storage database written in ANSI C, with a multi-language API, from Redis Labs. An input validation error vulnerability exists in Redis due to an integer overflow in the COPY command for lar...

redis -- multiple vulnerabilities

Redis project reports: Vulnerability in the STRALGO LCS command An integer overflow bug in Redis version 6.0 or newer could be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. Vulnerability in the COPY command for large intsets An...

Metasploit Wrap-Up

Operations shell Operations and management software make popular targets due to their users typically having elevated privileges across a network. Our own wvu contributed the VMware vRealize Operations vROps Manager SSRF RCE exploit module for the vulnerabilities discovered by security researcher...

Redis Extractor

This module connects to a Redis instance and retrieves keys and data stored. Module Options msf use auxiliary/gather/redisextractor msf auxiliaryredisextractor show actions ...actions... msf auxiliaryredisextractor set ACTION msf auxiliaryredisextractor show options ...show and set options... msf...

GHSA-35Q2-47Q7-3PC3 Node-Redis potential exponential regex in monitor mode

Impact When a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. Patches The problem was fixed in commit 2d11b6d and was released in version 3.1.1. References 1569...

1-of (>=1.0.0, <=1.0.1), 3klesmanager-common (>=2.0.0, <=2.0.1) +5782 more potentially affected by CVE-2021-29469 via redis (>=2.6.0-0, <=3.1.0)

redis NPM version =2.6.0-0, =1.0.0, =2.0.0, =0.0.12, =0.0.12, =3.10.1, =1.0.0, =0.7.0, =1.0.0, =1.0.2, =1.2.1, =2.0.0, =1.0.0, =1.0.0, =2.4.0 and more Source cves: CVE-2021-29469 Source advisory: OSV:GHSA-35Q2-47Q7-3PC3...

Node-Redis potential exponential regex in monitor mode

Impact When a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. Patches The problem was fixed in commit 2d11b6d and was released in version 3.1.1. References 1569...

Regular Expression Denial Of Service (ReDoS)

redis is vulnerable to regular expression denial of service. The vulnerability exists due to exponential backtracking on some strings when a client is in monitoring mode...

CVE-2021-29469

Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. The issue is patched in version 3.1.1...

CVE-2021-29469

Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. The issue is patched in version 3.1.1...

DEBIAN-CVE-2021-29469

Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. The issue is patched in version 3.1.1...

CVE-2021-29469

Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. The issue is patched in version 3.1.1...

UBUNTU-CVE-2021-29469

Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. The issue is patched in version 3.1.1...

Code injection

Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. The issue is patched in version 3.1.1...

CVE-2021-29469 Potential exponential regex in monitor mode

Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. The issue is patched in version 3.1.1...

CVE-2021-29469

Node-redis (Node.js Redis client) is vulnerable prior to version 3.1.1 due to a regex used to detect monitor messages that can backtrack exponentially, potentially causing a denial of service when a client is in monitoring mode. The issue is fixed in version 3.1.1. Affected context includes IBM a...