Alpine: multiple redis packages: security update to 6.2.6-r0

high Tenable Self-Hosted Container Security Plugin ID 406917

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- Redis is an open source, in-memory database that persists on disk. The redis-cli command line tool and
redis-sentinel service may be vulnerable to integer overflow when parsing specially crafted large multi-
bulk network replies. This is a result of a vulnerability in the underlying hiredis library which does not
perform an overflow check before calling the calloc() heap allocation function. This issue only impacts
systems with heap allocators that do not perform their own overflow checks. Most modern systems do and are
therefore not likely to be affected. Furthermore, by default redis-sentinel uses the jemalloc allocator
which is also not vulnerable. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14.
(CVE-2021-32762)

- Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted
Lua scripts executing in Redis can cause the heap-based Lua stack to be overflowed, due to incomplete
checks for this condition. This can result with heap corruption and potentially remote code execution.
This problem exists in all versions of Redis with Lua scripting support, starting from 2.6. The problem is
fixed in versions 6.2.6, 6.0.16 and 5.0.14. For users unable to update an additional workaround to
mitigate the problem without patching the redis-server executable is to prevent users from executing Lua
scripts. This can be done using ACL to restrict EVAL and EVALSHA commands. (CVE-2021-32626)

- Redis is an open source, in-memory database that persists on disk. In affected versions an integer
overflow bug in Redis can be exploited to corrupt the heap and potentially result with remote code
execution. The vulnerability involves changing the default proto-max-bulk-len and client-query-buffer-
limit configuration parameters to very large values and constructing specially crafted very large stream
elements. The problem is fixed in Redis 6.2.6, 6.0.16 and 5.0.14. For users unable to upgrade an
additional workaround to mitigate the problem without patching the redis-server executable is to prevent
users from modifying the proto-max-bulk-len configuration parameter. This can be done using ACL to
restrict unprivileged users from using the CONFIG SET command. (CVE-2021-32627)

- Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the ziplist
data structure used by all versions of Redis can be exploited to corrupt the heap and potentially result
with remote code execution. The vulnerability involves modifying the default ziplist configuration
parameters (hash-max-ziplist-entries, hash-max-ziplist-value, zset-max-ziplist-entries or zset-max-
ziplist-value) to a very large value, and then constructing specially crafted commands to create very
large ziplists. The problem is fixed in Redis versions 6.2.6, 6.0.16, 5.0.14. An additional workaround to
mitigate the problem without patching the redis-server executable is to prevent users from modifying the
above configuration parameters. This can be done using ACL to restrict unprivileged users from using the
CONFIG SET command. (CVE-2021-32628)

- Redis is an open source, in-memory database that persists on disk. When using the Redis Lua Debugger,
users can send malformed requests that cause the debugger’s protocol parser to read data beyond the actual
buffer. This issue affects all versions of Redis with Lua debugging support (3.2 or newer). The problem is
fixed in versions 6.2.6, 6.0.16 and 5.0.14. (CVE-2021-32672)

Plugin Details

Severity: High

ID: 406917

Version: Revision 1.27

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/31/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 97.17

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2021-32762

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/4/2021

Reference Information

CVE: CVE-2021-32626, CVE-2021-32627, CVE-2021-32628, CVE-2021-32672, CVE-2021-32675, CVE-2021-32687, CVE-2021-32762, CVE-2021-41099

Detections

Analytics