Debian DLA-2783-1 : hiredis - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2783 advisory. - Hiredis is a minimalistic C client library for the Redis database. In affected versions Hiredis is vulnurable to integer overflow if provided maliciously crafted or...

Vulnerability in Lua Debugger in Redis

...

Redis input validation error vulnerability

Hiredis is a C client for Redis databases. Hiredis suffers from a security vulnerability that allows attackers to provide maliciously crafted or corrupted RESP, mult-bulk protocol data that can lead to integer overflows. No detailed vulnerability details are currently available...

Redis < 5.0.14, 6.0.x < 6.0.16, 6.1.x < 6.2.6 Multiple Vulnerabilities

Redis is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:redis:redis"; if description...

Redis Stack Overflow Vulnerability (GHSA-p486-xggp-782c)

Redis is prone to a heap-based stack overflow vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:redis:redis"; if...

Redis Integer Overflow Vulnerability (GHSA-f434-69fm-g45v)

Redis is prone to an integer overflow vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:redis:redis"; if description...

Redis Lua Debugger Vulnerability (GHSA-9mj9-xx53-qmxm)

Redis is prone to a vulnerability in the Lua Debugger. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:redis:redis"; if descripti...

FreeBSD : redis -- multiple vulnerabilities (9b4806c1-257f-11ec-9db5-0800270512f4)

The Redis Team reports : CVE-2021-41099 Integer to heap buffer overflow handling certain string commands and network payloads, when proto-max-bulk-len is manually configured. CVE-2021-32762 Integer to heap buffer overflow issue in redis-cli and redis-sentinel parsing large multi-bulk replies on...

CVE-2021-32627

An integer overflow issue was found in redis. The vulnerability involves changing the default "proto-max-bulk-len" and "client-query-buffer-limit" configuration parameters to very large values and constructing specially crafted large stream elements. This flaw allows a remote attacker to corrupt...

CVE-2021-41099

An integer overflow issue was found in redis in the underlying string library. The vulnerability involves changing the default "proto-max-bulk-len" configuration parameter to a very large value and constructing specially crafted network payloads or commands. This flaw allows a remote attacker to...

CVE-2021-32672

A flaw was found in redis. When using the Redis Lua Debugger, users can send malformed requests that cause the debugger’s protocol parser to read data beyond the actual buffer, potentially leading to an information disclosure...

CVE-2021-32628

An integer overflow issue was found in the redis ziplist data structure. The vulnerability involves modifying the default ziplist configuration parameters hash-max-ziplist-entries, hash-max-ziplist-value, zset-max-ziplist-entries or zset-max-ziplist-value to a very large value, and then...

CVE-2021-32626

A heap buffer overflow was found in redis. Specially crafted Lua scripts executing in Redis cause the heap-based Lua stack to overflow due to incomplete checks for this condition. This flaw allows a remote attacker to corrupt the heap and potentially trigger remote code execution. The highest...

CVE-2021-32675

A flaw was found in redis. When parsing an incoming Redis Standard Protocol RESP request, redis allocates memory according to user-specified values, which determine the number of elements in the multi-bulk header and size of each element in the bulk header. This flaw allows an unauthenticated,...

CVE-2021-32687

An integer overflow issue was found in redis. The vulnerability involves changing the default "set-max-intset-entries" configuration parameter to a very large value and constructing specially crafted commands to manipulate sets. This flaw allows a remote attacker to leak arbitrary contents of the...

CVE-2021-32762

An integer overflow issue leading to heap buffer overflow was found in the hiredis library. The "redis-cli" command-line tool and "redis-sentinel" service may be vulnerable to this flaw when parsing specially crafted, large multi-bulk network replies. This flaw allows a remote attacker to corrupt...

Remote Code Execution (RCE)

Redis is vulnerable to remote code execution. The vulnerability exists due to an integer overflow bug which can be exploited to corrupt the heap and potentially be used to leak arbitrary contents of the heap or trigger remote code execution...

Denial Of Service (DoS)

Redis is vulnerable to denial of service. An attacker may exploit the vulnerability by injecting a malicious requests over multiple connections can cause the server to allocate significant amount of memory causing it to crash...

Denial Of Service (DoS)

Redis is vulnerable to denial of service. The vulnerability exists due to the debuggers protocol parser to read data beyond the actual buffer...

Denial Of Service (DoS)

Redis is vulnerable to denial of service. An integer overflow bug in Redis can be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves changing the default proto-max-bulk-len and client-query-buffer-limit configuration parameters to very larg...