Updated redis package fixes security vulnerabilities
Publication date: 25 Jul 2021Modification date: 25 Jul 2021
Type: security
Affected Mageia releases : 8
CVE: CVE-2021-29477 , CVE-2021-29478 , CVE-2021-32761
Description
An integer overflow bug in Redis version 6.0 or newer could be exploited using
the `STRALGO LCS` command to corrupt the heap and potentially result with
remote code execution (CVE-2021-29477).
An integer overflow bug in Redis 6.2 before 6.2.3 could be exploited to corrupt
the heap and potentially result with remote code execution (CVE-2021-29478).
A vulnerability involving out-of-bounds read and integer overflow to buffer
overflow exists starting with version 2.2 and prior to versions 5.0.13, 6.0.15
and 6.2.5. On 32-bit systems, Redis `*BIT*` command are vulnerable to integer
overflow that can potentially be exploited to corrupt the heap, leak arbitrary
heap contents or trigger remote code execution (CVE-2021-32761).
References
- https://bugs.mageia.org/show_bug.cgi?id=29036
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/BPWBIZXA67JFIB63W2CNVVILCGIC2ME5/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/BHWOF7CBVUGDK3AN6H3BN3VNTH2TDUZZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/SN7INTZFE34MIQJO7WDDTIY5LIBGN6GI/
- https://www.debian.org/lts/security/2021/dla-2717
- https://github.com/redis/redis/security/advisories/GHSA-8wxq-j7rp-g8wj
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29477
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29478
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32761
SRPMS
8/core
- redis-6.0.15-1.mga8