CVE-2021-32672
Vulnerability in Lua Debugger in Redis
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 4, 2021
- Updated
- Aug 3, 2024
- Reserved
- May 12, 2021
Description
Redis is an open source, in-memory database that persists on disk. When using the Redis Lua Debugger, users can send malformed requests that cause the debugger’s protocol parser to read data beyond the actual buffer. This issue affects all versions of Redis with Lua debugging support (3.2 or newer). The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N | GitHub_M |
Weaknesses
- CWE-125 Out-of-bounds Read
Affected Products
| Product | Versions |
|---|---|
redisredis |
|
References
- https://github.com/redis/redis/security/advisories/GHSA-9mj9-xx53-qmxm
- https://github.com/redis/redis/commit/6ac3c0b7abd35f37201ed2d6298ecef4ea1ae1dd
- FEDORA-2021-8913c7900cvendor-advisory
- FEDORA-2021-61c487f241vendor-advisory
- FEDORA-2021-aa94492a09vendor-advisory
- DSA-5001vendor-advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://security.netapp.com/advisory/ntap-20211104-0003/
- GLSA-202209-17vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.