CVE-2021-32672

Published: 4 October 2021

Redis is an open source, in-memory database that persists on disk. When using the Redis Lua Debugger, users can send malformed requests that cause the debugger’s protocol parser to read data beyond the actual buffer. This issue affects all versions of Redis with Lua debugging support (3.2 or newer). The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14.

Priority

CVSS 3 base score: 4.3

Status

Package	Release	Status
redis Launchpad, Ubuntu, Debian	bionic	Needed
	focal	Needed
	hirsute	Ignored (reached end-of-life)
	impish	Needed
	jammy	Not vulnerable (5:6.0.16-1)
	trusty	Not vulnerable (code not present)
	upstream	Released (5:6.0.16-1)
	xenial	Ignored (out of standard support)

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32672
https://github.com/redis/redis/security/advisories/GHSA-9mj9-xx53-qmxm
https://github.com/redis/redis/commit/6ac3c0b7abd35f37201ed2d6298ecef4ea1ae1dd
NVD
Launchpad
Debian

Bugs

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›