Detections
Analytics
Alpine: multiple redis packages: security update to 6.2.0-r0
high Tenable Self-Hosted Container Security Plugin ID 406913
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- A heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when
using a heap allocator other than jemalloc or glibc's malloc, leading to potential out of bound write or
process crash. Effectively this flaw does not affect the vast majority of users, who use jemalloc or glibc
malloc. (CVE-2021-3470)
- Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an
integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and
potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the
maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the
limit is significantly increased, receiving a large request from a client may trigger several integer
overflow scenarios, which would result with buffer overflow and heap corruption. We believe this could in
certain conditions be exploited for remote code execution. By default, authenticated Redis users have
access to all configuration parameters and can therefore use the “CONFIG SET proto-max-bulk-len” to change
the safe default, making the system vulnerable. **This problem only affects 32-bit Redis (on a 32-bit
system, or as a 32-bit executable running on a 64-bit system).** The problem is fixed in version 6.2, and
the fix is back ported to 6.0.11 and 5.0.11. Make sure you use one of these versions if you are running
32-bit Redis. An additional workaround to mitigate the problem without patching the redis-server
executable is to prevent clients from directly executing `CONFIG SET`: Using Redis 6.0 or newer, ACL
configuration can be used to block the command. Using older versions, the `rename-command` configuration
directive can be used to rename the command to a random string unknown to users, rendering it
inaccessible. Please note that this workaround may have an additional impact on users or operational
systems that expect `CONFIG SET` to behave in certain ways. (CVE-2021-21309)
See Also
Plugin Details
Severity: High
ID: 406913
Version: Revision 1.27
Type: Local
Published: 10/31/2023
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 6.9
Percentile: 96.99
CVSS v2
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 4.8
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P
CVSS Score Source: CVE-2021-21309
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.7
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 2/26/2021
Reference Information
CVE: CVE-2021-21309, CVE-2021-3470