CVEvulnerability

CVE-2021-32672

4.3 MEDIUM Published 2021-10-04 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-10-04
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
Weaknesses
CWE-125

Description

Redis is an open source, in-memory database that persists on disk. When using the Redis Lua Debugger, users can send malformed requests that cause the debugger’s protocol parser to read data beyond the actual buffer. This issue affects all versions of Redis with Lua debugging support (3.2 or newer). The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14.

Affected configurations

• redis redis (>= 3.2.0 < 5.0.14) • redis redis (>= 6.0.0 < 6.0.16) • redis redis (>= 6.2.0 < 6.2.6) • redhat software collections • redhat enterprise linux 8.0 • debian debian linux 10.0 • debian debian linux 11.0 • fedoraproject fedora 33 • fedoraproject fedora 34 • fedoraproject fedora 35 • netapp management services for element software • netapp management services for netapp hci • oracle communications operations monitor 4.3 • oracle communications operations monitor 4.4 • oracle communications operations monitor 5.0

Related

Weakness · CWE (1)

  • CWE-125 Out-of-bounds Read weakness

References