CVE-2021-32762

NameCVE-2021-32762
DescriptionRedis is an open source, in-memory database that persists on disk. The redis-cli command line tool and redis-sentinel service may be vulnerable to integer overflow when parsing specially crafted large multi-bulk network replies. This is a result of a vulnerability in the underlying hiredis library which does not perform an overflow check before calling the calloc() heap allocation function. This issue only impacts systems with heap allocators that do not perform their own overflow checks. Most modern systems do and are therefore not likely to be affected. Furthermore, by default redis-sentinel uses the jemalloc allocator which is also not vulnerable. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2810-1, DSA-5001-1, ELA-512-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
redis (PTS)jessie, jessie (lts)2:2.8.17-1+deb8u12fixed
stretch (security)3:3.2.6-3+deb9u9fixed
stretch (lts), stretch3:3.2.6-3+deb9u12fixed
buster (security), buster, buster (lts)5:5.0.14-1+deb10u5fixed
bullseye5:6.0.16-1+deb11u2fixed
bullseye (security)5:6.0.16-1+deb11u3fixed
bookworm (security), bookworm5:7.0.15-1~deb12u1fixed
sid, trixie5:7.0.15-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
redissourcejessie2:2.8.17-1+deb8u9ELA-512-1
redissourcestretch3:3.2.6-3+deb9u8DLA-2810-1
redissourcebuster5:5.0.14-1+deb10u1DSA-5001-1
redissourcebullseye5:6.0.16-1+deb11u1DSA-5001-1
redissource(unstable)5:6.0.16-1

Notes

https://github.com/redis/redis/security/advisories/GHSA-833w-8v3m-8wwr

Search for package or bug name: Reporting problems