It was discovered that there were a number of integer overflow issues in Redis, a persistent 'NoSQL'-style key-value database. It is currently believed that the issues only affect 32-bit based systems.

For Debian 9 'Stretch', this problem has been fixed in version 3:3.2.6-3+deb9u4.

We recommend that you upgrade your redis packages.

For the detailed security status of redis please refer to its security tracker page at: https://security-tracker.debian.org/tracker/redis

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202103-02 (Redis: Remote code execution)

    It was discovered that there were a number of integer overflow issues in       Redis.
  Impact :

    A remote attacker, able to connect to a Redis instance, could send a       malicious crafted large request possibly resulting in the execution of       arbitrary code with the privileges of the process or a Denial of Service       condition.
  Workaround :

    There is no known workaround at this time.

This update for redis fixes the following issues :

redis 6.0.13

  - CVE-2021-29477: Integer overflow in STRALGO LCS command     (boo#1185729)

  - CVE-2021-29478: Integer overflow in COPY command for     large intsets (boo#1185730)

  - Cluster: Skip unnecessary check which may prevent     failure detection

  - Fix performance regression in BRPOP on Redis 6.0

  - Fix edge-case when a module client is unblocked

redis 6.0.12 :

  - Fix compilation error on non-glibc systems if jemalloc     is not used

redis 6.0.11 :

  - CVE-2021-21309: Avoid 32-bit overflows when     proto-max-bulk-len is set high (boo#1182657)

  - Fix handling of threaded IO and CLIENT PAUSE (failover),     could lead to data loss or a crash

  - Fix the selection of a random element from large hash     tables

  - Fix broken protocol in client tracking     tracking-redir-broken message

  - XINFO able to access expired keys on a replica

  - Fix broken protocol in redis-benchmark when used with -a     or --dbnum 

  - Avoid assertions (on older kernels) when testing arm64     CoW bug

  - CONFIG REWRITE should honor umask settings

  - Fix firstkey,lastkey,step in COMMAND command for some     commands

  - RM_ZsetRem: Delete key if empty, the bug could leave     empty zset keys 

redis 6.0.10 :

Command behavior changes :

  - SWAPDB invalidates WATCHed keys (#8239)

  - SORT command behaves differently when used on a writable     replica (#8283)

  - EXISTS should not alter LRU (#8016) In Redis 5.0 and 6.0     it would have touched the LRU/LFU of the key.

  - OBJECT should not reveal logically expired keys (#8016)     Will now behave the same TYPE or any other non-DEBUG     command.

  - GEORADIUS[BYMEMBER] can fail with -OOM if Redis is over     the memory limit (#8107)

Other behavior changes :

  - Sentinel: Fix missing updates to the config file after     SENTINEL SET command (#8229)

  - CONFIG REWRITE is atomic and safer, but requires write     access to the config file's folder (#7824, #8051) This     change was already present in 6.0.9, but was missing     from the release notes.

Bug fixes with compatibility implications (bugs introduced in Redis 6.0) :

  - Fix RDB CRC64 checksum on big-endian systems (#8270) If     you're using big-endian please consider the     compatibility implications with RESTORE, replication and     persistence.

  - Fix wrong order of key/value in Lua's map response     (#8266) If your scripts use redis.setresp() or return a     map (new in Redis 6.0), please consider the     implications.

Bug fixes :

  - Fix an issue where a forked process deletes the parent's     pidfile (#8231)

  - Fix crashes when enabling io-threads-do-reads (#8230)

  - Fix a crash in redis-cli after executing cluster backup     (#8267)

  - Handle output buffer limits for module blocked clients     (#8141) Could result in a module sending reply to a     blocked client to go beyond the limit.

  - Fix setproctitle related crashes. (#8150, #8088) Caused     various crashes on startup, mainly on Apple M1 chips or     under instrumentation.

  - Backup/restore cluster mode keys to slots map for     repl-diskless-load=swapdb (#8108) In cluster mode with     repl-diskless-load, when loading failed, slot map     wouldn't have been restored.

  - Fix oom-score-adj-values range, and bug when used in     config file (#8046) Enabling setting this in the config     file in a line after enabling it, would have been buggy.

  - Reset average ttl when empty databases (#8106) Just     causing misleading metric in INFO

  - Disable rehash when Redis has child process (#8007) This     could have caused excessive CoW during BGSAVE,     replication or AOFRW.

  - Further improved ACL algorithm for picking categories     (#7966) Output of ACL GETUSER is now more similar to the     one provided by ACL SETUSER.

  - Fix bug with module GIL being released prematurely     (#8061) Could in theory (and rarely) cause     multi-threaded modules to corrupt memory.

  - Reduce effect of client tracking causing feedback loop     in key eviction (#8100)

  - Fix cluster access to unaligned memory (SIGBUS on old     ARM) (#7958)

  - Fix saving of strings larger than 2GB into RDB files     (#8306)

Additional improvements :

  - Avoid wasteful transient memory allocation in certain     cases (#8286, #5954)

Platform / toolchain support related improvements :

  - Fix crash log registers output on ARM. (#8020)

  - Add a check for an ARM64 Linux kernel bug (#8224) Due to     the potential severity of this issue, Redis will print     log warning on startup.

  - Raspberry build fix. (#8095)

New configuration options :

  - oom-score-adj-values config can now take absolute values     (besides relative ones) (#8046)

Module related fixes :

  - Moved RMAPI_FUNC_SUPPORTED so that it's usable (#8037)

  - Improve timer accuracy (#7987)

  - Allow '\0' inside of result of RM_CreateStringPrintf     (#6260)

redis 6.0.9 :

  - potential heap overflow when using a heap allocator     other than jemalloc or glibc's malloc. Does not affect     the openSUSE package - boo#1178205 

  - Memory reporting of clients argv

  - Add redis-cli control on raw format line delimiter

  - Add redis-cli support for rediss:// -u prefix

  - WATCH no longer ignores keys which have expired for     MULTI/EXEC

  - Correct OBJECT ENCODING response for stream type

  - Allow blocked XREAD on a cluster replica

  - TLS: Do not require CA config if not used

  - multiple bug fixes

  - Additions to modules API

redis 6.0.8 (jsc#PM-1615, jsc#PM-1622, jsc#PM-1681, jsc#ECO-2417, jsc#ECO-2867, jsc#PM-1547, jsc#CAPS-56, jsc#SLE-11578, jsc#SLE-12821) :

  - bug fixes when using with Sentinel

  - bug fixes when using CONFIG REWRITE

  - Remove THP warning when set to madvise

  - Allow EXEC with read commands on readonly replica in     cluster

  - Add masters/replicas options to redis-cli --cluster call     command

  - includes changes from 6.0.7 :

  - CONFIG SET could hung the client when arrives during     RDB/ROF loading

  - LPOS command when RANK is greater than matches responded     with broken protocol

  - Add oom-score-adj configuration option to control Linux     OOM killer

  - Show IO threads statistics and status in INFO output

  - Add optional tls verification mode (see     tls-auth-clients)

redis 6.0.6 :

  - Fix crash when enabling CLIENT TRACKING with prefix

  - EXEC always fails with EXECABORT and multi-state is     cleared

  - RESTORE ABSTTL won't store expired keys into the db

  - redis-cli better handling of non-pritable key names

  - TLS: Ignore client cert when tls-auth-clients off

  - Tracking: fix invalidation message on flush

  - Notify systemd on Sentinel startup

  - Fix crash on a misuse of STRALGO

  - Few fixes in module API

  - Fix a few rare leaks (STRALGO error misuse, Sentinel)

  - Fix a possible invalid access in defrag of scripts

  - Add LPOS command to search in a list

  - Use user+pass for MIGRATE in redis-cli and     redis-benchmark in cluster mode

  - redis-cli support TLS for --pipe, --rdb and --replica     options

  - TLS: Session caching configuration support

redis 6.0.5 :

  - Fix handling of speical chars in ACL LOAD

  - Make Redis Cluster more robust about operation errors     that may lead to two clusters to mix together

  - Revert the sendfile() implementation of RDB transfer

  - Fix TLS certificate loading for chained certificates

  - Fix AOF rewirting of KEEPTTL SET option

  - Fix MULTI/EXEC behavior during -BUSY script errors

Redis Development team reports :

Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer overflow scenarios, which would result with buffer overflow and heap corruption.

This update for redis fixes the following issues :

redis was updated to 6.0.13 :

CVE-2021-29477: Integer overflow in STRALGO LCS command (bsc#1185729)

CVE-2021-29478: Integer overflow in COPY command for large intsets (bsc#1185730)

Cluster: Skip unnecessary check which may prevent failure detection

Fix performance regression in BRPOP on Redis 6.0

Fix edge-case when a module client is unblocked

redis 6.0.12 :

Fix compilation error on non-glibc systems if jemalloc is not used

redis 6.0.11 :

CVE-2021-21309: Avoid 32-bit overflows when proto-max-bulk-len is set high (bsc#1182657)

Fix handling of threaded IO and CLIENT PAUSE (failover), could lead to data loss or a crash

Fix the selection of a random element from large hash tables

Fix broken protocol in client tracking tracking-redir-broken message

XINFO able to access expired keys on a replica

Fix broken protocol in redis-benchmark when used with -a or

--dbnum

Avoid assertions (on older kernels) when testing arm64 CoW bug

CONFIG REWRITE should honor umask settings

Fix firstkey,lastkey,step in COMMAND command for some commands

RM_ZsetRem: Delete key if empty, the bug could leave empty zset keys

Switch systemd type of the sentinel service from notify to simple.
This can be reverted when updating to 6.2 which fixes https://github.com/redis/redis/issues/7284 .

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5221-1 advisory.

  - Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted     Lua scripts executing in Redis can cause the heap-based Lua stack to be overflowed, due to incomplete     checks for this condition. This can result with heap corruption and potentially remote code execution.
    This problem exists in all versions of Redis with Lua scripting support, starting from 2.6. The problem is     fixed in versions 6.2.6, 6.0.16 and 5.0.14. For users unable to update an additional workaround to     mitigate the problem without patching the redis-server executable is to prevent users from executing Lua     scripts. This can be done using ACL to restrict EVAL and EVALSHA commands. (CVE-2021-32626)

  - Redis is an open source, in-memory database that persists on disk. In affected versions an integer     overflow bug in Redis can be exploited to corrupt the heap and potentially result with remote code     execution. The vulnerability involves changing the default proto-max-bulk-len and client-query-buffer-     limit configuration parameters to very large values and constructing specially crafted very large stream     elements. The problem is fixed in Redis 6.2.6, 6.0.16 and 5.0.14. For users unable to upgrade an     additional workaround to mitigate the problem without patching the redis-server executable is to prevent     users from modifying the proto-max-bulk-len configuration parameter. This can be done using ACL to     restrict unprivileged users from using the CONFIG SET command. (CVE-2021-32627)

  - Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the ziplist     data structure used by all versions of Redis can be exploited to corrupt the heap and potentially result     with remote code execution. The vulnerability involves modifying the default ziplist configuration     parameters (hash-max-ziplist-entries, hash-max-ziplist-value, zset-max-ziplist-entries or zset-max-     ziplist-value) to a very large value, and then constructing specially crafted commands to create very     large ziplists. The problem is fixed in Redis versions 6.2.6, 6.0.16, 5.0.14. An additional workaround to     mitigate the problem without patching the redis-server executable is to prevent users from modifying the     above configuration parameters. This can be done using ACL to restrict unprivileged users from using the     CONFIG SET command. (CVE-2021-32628)

  - Redis is an open source, in-memory database that persists on disk. When using the Redis Lua Debugger,     users can send malformed requests that cause the debugger's protocol parser to read data beyond the actual     buffer. This issue affects all versions of Redis with Lua debugging support (3.2 or newer). The problem is     fixed in versions 6.2.6, 6.0.16 and 5.0.14. (CVE-2021-32672)

  - Redis is an open source, in-memory database that persists on disk. When parsing an incoming Redis Standard     Protocol (RESP) request, Redis allocates memory according to user-specified values which determine the     number of elements (in the multi-bulk header) and size of each element (in the bulk header). An attacker     delivering specially crafted requests over multiple connections can cause the server to allocate     significant amount of memory. Because the same parsing mechanism is used to handle authentication     requests, this vulnerability can also be exploited by unauthenticated users. The problem is fixed in Redis     versions 6.2.6, 6.0.16 and 5.0.14. An additional workaround to mitigate this problem without patching the     redis-server executable is to block access to prevent unauthenticated users from connecting to Redis. This     can be done in different ways: Using network access control tools like firewalls, iptables, security     groups, etc. or Enabling TLS and requiring users to authenticate using client side certificates.
    (CVE-2021-32675)

  - Redis is an open source, in-memory database that persists on disk. An integer overflow bug affecting all     versions of Redis can be exploited to corrupt the heap and potentially be used to leak arbitrary contents     of the heap or trigger remote code execution. The vulnerability involves changing the default set-max-     intset-entries configuration parameter to a very large value and constructing specially crafted commands     to manipulate sets. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. An additional     workaround to mitigate the problem without patching the redis-server executable is to prevent users from     modifying the set-max-intset-entries configuration parameter. This can be done using ACL to restrict     unprivileged users from using the CONFIG SET command. (CVE-2021-32687)

  - Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the     underlying string library can be used to corrupt the heap and potentially result with denial of service or     remote code execution. The vulnerability involves changing the default proto-max-bulk-len configuration     parameter to a very large value and constructing specially crafted network payloads or commands. The     problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. An additional workaround to mitigate the     problem without patching the redis-server executable is to prevent users from modifying the proto-max-     bulk-len configuration parameter. This can be done using ACL to restrict unprivileged users from using the     CONFIG SET command. (CVE-2021-41099)

  - Redis is an in-memory database that persists on disk. A vulnerability involving out-of-bounds read and     integer overflow to buffer overflow exists starting with version 2.2 and prior to versions 5.0.13, 6.0.15,     and 6.2.5. On 32-bit systems, Redis `*BIT*` command are vulnerable to integer overflow that can     potentially be exploited to corrupt the heap, leak arbitrary heap contents or trigger remote code     execution. The vulnerability involves changing the default `proto-max-bulk-len` configuration parameter to     a very large value and constructing specially crafted commands bit commands. This problem only affects     Redis on 32-bit platforms, or compiled as a 32-bit binary. Redis versions 5.0.`3m 6.0.15, and 6.2.5     contain patches for this issue. An additional workaround to mitigate the problem without patching the     `redis-server` executable is to prevent users from modifying the `proto-max-bulk-len` configuration     parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.
    (CVE-2021-32761)

  - Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an     integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and     potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the     maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the     limit is significantly increased, receiving a large request from a client may trigger several integer     overflow scenarios, which would result with buffer overflow and heap corruption. We believe this could in     certain conditions be exploited for remote code execution. By default, authenticated Redis users have     access to all configuration parameters and can therefore use the CONFIG SET proto-max-bulk-len to change     the safe default, making the system vulnerable. **This problem only affects 32-bit Redis (on a 32-bit     system, or as a 32-bit executable running on a 64-bit system).** The problem is fixed in version 6.2, and     the fix is back ported to 6.0.11 and 5.0.11. Make sure you use one of these versions if you are running     32-bit Redis. An additional workaround to mitigate the problem without patching the redis-server     executable is to prevent clients from directly executing `CONFIG SET`: Using Redis 6.0 or newer, ACL     configuration can be used to block the command. Using older versions, the `rename-command` configuration     directive can be used to rename the command to a random string unknown to users, rendering it     inaccessible. Please note that this workaround may have an additional impact on users or operational     systems that expect `CONFIG SET` to behave in certain ways. (CVE-2021-21309)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
146887	Debian DLA-2576-1 : redis security update	Nessus	Debian Local Security Checks	3/1/2021	3/19/2021	high
148268	GLSA-202103-02 : Redis: Remote code execution	Nessus	Gentoo Local Security Checks	4/1/2021	1/12/2024	high
149549	openSUSE Security Update : redis (openSUSE-2021-682)	Nessus	SuSE Local Security Checks	5/18/2021	1/1/2024	high
146798	FreeBSD : redis -- Integer overflow on 32-bit systems (0e38b8f8-75dd-11eb-83f2-8c164567ca3c)	Nessus	FreeBSD Local Security Checks	2/24/2021	3/18/2021	high
149804	SUSE SLES15 Security Update : redis (SUSE-SU-2021:1652-1)	Nessus	SuSE Local Security Checks	5/20/2021	12/29/2023	high
183135	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM : Redis vulnerabilities (USN-5221-1)	Nessus	Ubuntu Local Security Checks	10/16/2023	12/22/2023	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high