Mageia alert MGASA-2021-0373 (redis)
| From: | Mageia Updates <buildsystem-daemon@mageia.org> | |
| To: | updates-announce@ml.mageia.org | |
| Subject: | [updates-announce] MGASA-2021-0373: Updated redis package fixes security vulnerabilities | |
| Date: | Sun, 25 Jul 2021 16:46:13 +0200 | |
| Message-ID: | <20210725144613.2346BA12FD@duvel.mageia.org> | |
| Archive-link: | Article |
MGASA-2021-0373 - Updated redis package fixes security vulnerabilities Publication date: 25 Jul 2021 URL: https://advisories.mageia.org/MGASA-2021-0373.html Type: security Affected Mageia releases: 8 CVE: CVE-2021-29477, CVE-2021-29478, CVE-2021-32761 Description: An integer overflow bug in Redis version 6.0 or newer could be exploited using the `STRALGO LCS` command to corrupt the heap and potentially result with remote code execution (CVE-2021-29477). An integer overflow bug in Redis 6.2 before 6.2.3 could be exploited to corrupt the heap and potentially result with remote code execution (CVE-2021-29478). A vulnerability involving out-of-bounds read and integer overflow to buffer overflow exists starting with version 2.2 and prior to versions 5.0.13, 6.0.15 and 6.2.5. On 32-bit systems, Redis `*BIT*` command are vulnerable to integer overflow that can potentially be exploited to corrupt the heap, leak arbitrary heap contents or trigger remote code execution (CVE-2021-32761). References: - https://bugs.mageia.org/show_bug.cgi?id=29036 - https://lists.fedoraproject.org/archives/list/package-ann... - https://lists.fedoraproject.org/archives/list/package-ann... - https://lists.fedoraproject.org/archives/list/package-ann... - https://www.debian.org/lts/security/2021/dla-2717 - https://github.com/redis/redis/security/advisories/GHSA-8... - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2... - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2... - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3... SRPMS: - 8/core/redis-6.0.15-1.mga8