Bug 2011000 (CVE-2021-32675)
Summary: | CVE-2021-32675 redis: Denial of service via Redis Standard Protocol (RESP) request | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Pedro Sampaio <psampaio> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | high | Docs Contact: | |
Priority: | high | ||
Version: | unspecified | CC: | agerstmayr, amackenz, amasferr, apevec, bcoca, bdettelb, caswilli, chazlett, chousekn, cmeyers, davidn, dbecker, drieden, fabian.deutsch, fedora, fpercoco, gblomqui, gghezzo, gparvin, hhorak, jal233, jcammara, jhardy, jjoyce, jobarker, jorton, jramanat, jschluet, jwong, kaycoth, lhh, lpeer, mabashia, mburns, mgoodwin, mkudlej, nathans, notting, osapryki, pahickey, rcollet, redis-maint, relrod, rhos-maint, rpetrell, sclewis, sdoran, slinaber, smcdonal, stcannon, tjochec, tkuratom, vmugicag |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | redis 6.2.6, redis 6.0.16, redis 5.0.14 | Doc Type: | If docs needed, set a value |
Doc Text: |
A flaw was found in redis. When parsing an incoming Redis Standard Protocol (RESP) request, redis allocates memory according to user-specified values, which determine the number of elements (in the multi-bulk header) and size of each element (in the bulk header). This flaw allows an unauthenticated, remote user delivering specially crafted requests over multiple connections to cause the server to allocate a significant amount of memory, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | 2021-10-15 02:08:29 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 2012205, 2011198, 2011638, 2011663, 2012185, 2012186, 2012187, 2012188, 2012189, 2012190, 2012191, 2012192, 2012193, 2012194, 2012195, 2012196, 2012204, 2012382, 2014264, 2015069, 2015236, 2015651, 2015866, 2015867 | ||
Bug Blocks: | 2011061 |
Description
Pedro Sampaio
2021-10-05 18:20:49 UTC
This issue has been addressed in the following products: Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 7 Via RHSA-2021:3873 https://access.redhat.com/errata/RHSA-2021:3873 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-32675 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:3918 https://access.redhat.com/errata/RHSA-2021:3918 This issue has been addressed in the following products: Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 7 Via RHSA-2021:3925 https://access.redhat.com/errata/RHSA-2021:3925 This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS Via RHSA-2021:3947 https://access.redhat.com/errata/RHSA-2021:3947 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Extended Update Support Via RHSA-2021:3944 https://access.redhat.com/errata/RHSA-2021:3944 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Extended Update Support Via RHSA-2021:3946 https://access.redhat.com/errata/RHSA-2021:3946 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:3945 https://access.redhat.com/errata/RHSA-2021:3945 This issue has been addressed in the following products: Red Hat Advanced Cluster Management for Kubernetes 2.1 for RHEL 8 Red Hat Advanced Cluster Management for Kubernetes 2.1 for RHEL 7 Via RHSA-2021:3949 https://access.redhat.com/errata/RHSA-2021:3949 This issue has been addressed in the following products: Red Hat OpenStack Platform 10.0 (Newton) Via RHSA-2021:3971 https://access.redhat.com/errata/RHSA-2021:3971 This issue has been addressed in the following products: Red Hat OpenStack Platform 13.0 - ELS Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS Via RHSA-2021:3980 https://access.redhat.com/errata/RHSA-2021:3980 This issue has been addressed in the following products: Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 Via RHSA-2021:4618 https://access.redhat.com/errata/RHSA-2021:4618 |