RHEL 8 : redis:5 (RHSA-2021:3918)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3918 advisory. Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets...

PT-2021-8168

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to an out-of-bound read in the resp readcap16 function. This can lead to a denial of service. The problem arises when the alloc len value is set to -1104926854,...

PT-2021-8159

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The vulnerability is related to an out-of-bound read in the resp report tgtpgs function. It was observed running syzkaller, which reported a slab-out-of-bounds error in memcpy and sg cop...

Redis input validation error vulnerability

Hiredis is a C client for Redis databases. Hiredis suffers from a security vulnerability that allows attackers to provide maliciously crafted or corrupted RESP, mult-bulk protocol data that can lead to integer overflows. No detailed vulnerability details are currently available...

FreeBSD : redis -- multiple vulnerabilities (9b4806c1-257f-11ec-9db5-0800270512f4)

The Redis Team reports : CVE-2021-41099 Integer to heap buffer overflow handling certain string commands and network payloads, when proto-max-bulk-len is manually configured. CVE-2021-32762 Integer to heap buffer overflow issue in redis-cli and redis-sentinel parsing large multi-bulk replies on...

CVE-2021-32675

Redis is an open source, in-memory database that persists on disk. When parsing an incoming Redis Standard Protocol RESP request, Redis allocates memory according to user-specified values which determine the number of elements in the multi-bulk header and size of each element in the bulk header. ...

CVE-2021-32675

Redis is an open source, in-memory database that persists on disk. When parsing an incoming Redis Standard Protocol RESP request, Redis allocates memory according to user-specified values which determine the number of elements in the multi-bulk header and size of each element in the bulk header. ...

CVE-2021-32765: Integer Overflow or Wraparound

Hiredis is a minimalistic C client library for the Redis database. In affected versions Hiredis is vulnurable to integer overflow if provided maliciously crafted or corrupted RESP mult-bulk protocol data. When parsing multi-bulk array-like replies, hiredis fails to check if count sizeofredisReply...

PT-2021-19914

Name of the Vulnerable Software and Affected Versions Hiredis affected versions not specified Description The issue arises from an integer overflow when Hiredis is provided with maliciously crafted or corrupted RESP mult-bulk protocol data. Specifically, when parsing multi-bulk array-like replies...

CVE-2021-32675: Allocation of Resources Without Limits or Throttling

Redis is an open source, in-memory database that persists on disk. When parsing an incoming Redis Standard Protocol RESP request, Redis allocates memory according to user-specified values which determine the number of elements in the multi-bulk header and size of each element in the bulk header. ...

CVE-2021-32765

Hiredis is a minimalistic C client library for the Redis database. In affected versions Hiredis is vulnurable to integer overflow if provided maliciously crafted or corrupted RESP mult-bulk protocol data. When parsing multi-bulk array-like replies, hiredis fails to check if count sizeofredisReply...

redis -- multiple vulnerabilities

The Redis Team reports: CVE-2021-41099 Integer to heap buffer overflow handling certain string commands and network payloads, when proto-max-bulk-len is manually configured. CVE-2021-32762 Integer to heap buffer overflow issue in redis-cli and redis-sentinel parsing large multi-bulk replies on so...

hiredis -- integer/buffer overflow

hiredis maintainers report: Hiredis is vulnurable to integer overflow if provided maliciously crafted or corrupted RESP mult-bulk protocol data. When parsing multi-bulk array-like replies, hiredis fails to check if count sizeofredisReply can be represented in SIZEMAX. If it can not, and the callo...

PT-2021-27862

Name of the Vulnerable Software and Affected Versions GnuTLS affected versions not specified Description The issue is related to a crash caused by the use of an uninitialized value. The crash occurs in the gnutls ocsp resp get status and gnutls ocsp resp import functions. Recommendations At the...

PT-2020-22291

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash caused by the use of an uninitialized value. The crash occurs in the smtp state ehlo resp and smtp statemach act functions,...

CVE-2020-9411: Undefined Security Weakness

The file transfer component of TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for IBM i contains a vulnerability that theoretically allows an attacker to perform unauthorized network file transfers to and from the file system accessible to the affected component. This...

PT-2020-4419

Name of the Vulnerable Software and Affected Versions: TIBCO Managed File Transfer Platform Server for IBM i versions 7.1.0 and below TIBCO Managed File Transfer Platform Server for IBM i version 8.0.0 Description: The issue is related to errors in the authentication request handling mechanism of...

PT-2018-1908

Name of the Vulnerable Software and Affected Versions GNU Wget versions prior to 1.19.5 Description The issue is related to a cookie injection vulnerability in the resp new function in http.c via a r sequence in a continuation line. This vulnerability is associated with the lack of processing of ...

tcpdump: Infinite loop due to a bug in print-resp.c:resp_get_length() in RESP parser

The RESP parser in tcpdump before 4.9.2 could enter an infinite loop due to a bug in print-resp.c:respgetlength...

PT-2018-5746

Name of the Vulnerable Software and Affected Versions: Qualcomm Android for MSM versions prior to security patch level 2018-04-05 Firefox OS for MSM versions prior to security patch level 2018-04-05 QRD Android versions prior to security patch level 2018-04-05 Description: The issue arises from t...