Integer Overflow

2024-01-1304:09:35

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

redis

integer overflow

vulnerability

heap overflow

remote code execution

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

Low

0.007 Low

EPSS

Percentile

81.1%

JSON

redis:sid is vulnerable to Integer Overflow. The vulnerability due to changing the default proto-max-bulk-len configuration parameter to a very large value and constructing specially crafted commands bit commands. It leads to heap overflow and potential remote code execution.

CPENameOperatorVersion
redis:sideq5:6.0.9-1
redis:sideq5:6.0.15-1
redis:3.18eq7.0.14-r0
redis:3.18eq7.0.13-r0
redis:3.18eq7.0.12-r0
redis:3.18eq7.0.11-r0
redis:3.16eq7.0.4-r0
redis:3.16eq7.0.14-r0
redis:3.16eq7.0.11-r0
redis:3.16eq7.0.2-r0

Name	Operator	Version
redis:sid	eq	5:6.0.9-1
redis:sid	eq	5:6.0.15-1
redis:3.18	eq	7.0.14-r0
redis:3.18	eq	7.0.13-r0
redis:3.18	eq	7.0.12-r0
redis:3.18	eq	7.0.11-r0
redis:3.16	eq	7.0.4-r0
redis:3.16	eq	7.0.14-r0
redis:3.16	eq	7.0.11-r0
redis:3.16	eq	7.0.2-r0