CVE-2021-41099
Assigner: GitHub_M
Published: 2021-10-04T18:05:11
State: PUBLISHED
affected: product: redis
vendor: redis
versions: status: affected
version: < 5.0.14
status: affected
version: >= 6.0.0, < 6.0.16
status: affected
version: >= 6.2.0, 6.2.6
descriptions: value: Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the underlying string library can be used to corrupt the heap and potentially result with denial of service or remote code execution. The vulnerability involves changing the default proto-max-bulk-len configuration parameter to a very large value and constructing specially crafted network payloads or commands. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the proto-max-bulk-len configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.
metrics: cvssV3_1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-190
description: CWE-190: Integer Overflow or Wraparound
type: CWE
descriptions: cweId: CWE-680
description: CWE-680: Integer Overflow to Buffer Overflow
type: CWE
source: advisory: GHSA-j3cr-9h5g-6cph
discovery: UNKNOWN
title: Integer overflow issue with strings in Redis