Bug 2011001 (CVE-2021-32672)

Summary:	CVE-2021-32672 redis: Out of bounds read in lua debugger protocol parser
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	agerstmayr, amackenz, amasferr, apevec, bcoca, bdettelb, caswilli, chazlett, chousekn, cmeyers, davidn, dbecker, drieden, fabian.deutsch, fedora, fpercoco, gblomqui, gghezzo, gparvin, hhorak, jal233, jcammara, jhardy, jjoyce, jobarker, jorton, jramanat, jschluet, jwong, kaycoth, lhh, lpeer, mabashia, mburns, mgoodwin, mkudlej, nathans, notting, osapryki, pahickey, rcollet, redis-maint, relrod, rhos-maint, rpetrell, sclewis, sdoran, slinaber, smcdonal, stcannon, tjochec, tkuratom, vmugicag
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	redis 6.2.6, redis 6.0.16, redis 5.0.14	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in redis. When using the Redis Lua Debugger, users can send malformed requests that cause the debugger’s protocol parser to read data beyond the actual buffer, potentially leading to an information disclosure.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-15 02:08:34 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2012197, 2012198, 2012199, 2012200, 2012201, 2012202, 2012203, 2012381, 2014263, 2015071, 2015238, 2015650, 2015868, 2015869
Bug Blocks:	2011061

Description Pedro Sampaio 2021-10-05 18:25:23 UTC

Redis is an open source, in-memory database that persists on disk. When using the Redis Lua Debugger, users can send malformed requests that cause the debugger’s protocol parser to read data beyond the actual buffer. This issue affects all versions of Redis with Lua debugging support (3.2 or newer). The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14.

References:

https://github.com/redis/redis/security/advisories/GHSA-9mj9-xx53-qmxm
https://github.com/redis/redis/commit/6ac3c0b7abd35f37201ed2d6298ecef4ea1ae1dd

Comment 1 Mauro Matteo Cascella 2021-10-08 14:46:41 UTC

Created redis tracking bugs for this issue:

Affects: epel-7 [bug 2012198]
Affects: fedora-all [bug 2012197]

Comment 4 errata-xmlrpc 2021-10-14 22:39:05 UTC

This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8
  Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 7

Via RHSA-2021:3873 https://access.redhat.com/errata/RHSA-2021:3873

Comment 5 Product Security DevOps Team 2021-10-15 02:08:34 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-32672

Comment 7 errata-xmlrpc 2021-10-20 03:55:23 UTC

This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8
  Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 7

Via RHSA-2021:3925 https://access.redhat.com/errata/RHSA-2021:3925

Comment 10 errata-xmlrpc 2021-10-20 19:44:49 UTC

This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.1 for RHEL 8
  Red Hat Advanced Cluster Management for Kubernetes 2.1 for RHEL 7

Via RHSA-2021:3949 https://access.redhat.com/errata/RHSA-2021:3949

Comment 11 errata-xmlrpc 2021-11-11 18:32:38 UTC

This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8

Via RHSA-2021:4618 https://access.redhat.com/errata/RHSA-2021:4618