Bug 1932634 (CVE-2021-21309)
| Summary: | CVE-2021-21309 redis: integer overflow when configurable limit for maximum supported bulk input size is too big on 32-bit platforms | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Guilherme de Almeida Suckevicz <gsuckevi> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | apevec, bcoca, chousekn, cmeyers, davidn, dbecker, fabian.deutsch, fpercoco, gblomqui, gghezzo, gparvin, hhorak, jal233, jcammara, jhardy, jjoyce, jobarker, jorton, jramanat, jschluet, jweiser, kaycoth, lberk, lhh, lpeer, mabashia, mburns, mgoodwin, nathans, notting, osapryki, rcollet, redis-maint, relrod, rhos-maint, sclewis, sdoran, slinaber, smcdonal, stcannon, thee, tkuratom, vmugicag |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | redis 5.0.11, redis 6.0.11, redis 6.2 | Doc Type: | If docs needed, set a value |
| Doc Text: |
An integer overflow was found in Redis. Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. The default size is 512MB which is a safe value for all platforms. Authenticated Redis users could increase the bulk input size by changing the "proto-max-bulk-len" configuration parameter, leading to heap corruption and potentially remote code execution.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-06-16 21:04:13 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1932635, 1932636, 1936438, 1936648 | ||
| Bug Blocks: | 1932637 | ||
|
Description
Guilherme de Almeida Suckevicz
2021-02-24 19:55:06 UTC
Created redis tracking bugs for this issue: Affects: epel-all [bug 1932636] Affects: fedora-all [bug 1932635] The affected version of the vulnerable component i.e. Redis 4.0 is not being consumed by either Ansible Automation Platform Or Ansible Tower. External References: https://github.com/redis/redis/security/advisories/GHSA-hgj8-vff2-7cjf Mitigation: As recommended in the upstream advisory, this issue can be mitigated by preventing clients from directly executing `CONFIG SET`: * Using Redis 6.0 or newer, ACL configuration can be used to block the command. * Using older versions, the `rename-command` configuration directive can be used to rename the command to a random string unknown to users, rendering it inaccessible. Statement: This issue only affects 32-bit Redis. Red Hat Enterprise Linux 8 and Red Hat Software Collections are not affected by this issue because they do not provide support for 32-bit Redis. The following products are not affected because the vulnerable component (Redis 4.0) is not being consumed: * Red Hat Ansible Automation Platform * Red Hat Ansible Tower * Red Hat OpenStack Platform This issue has been addressed in the following products: Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 7 Via RHSA-2021:2461 https://access.redhat.com/errata/RHSA-2021:2461 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-21309 This issue has been addressed in the following products: Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 7 Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 Via RHSA-2021:3016 https://access.redhat.com/errata/RHSA-2021:3016 |