USN-5221-1: Redis vulnerabilities

Releases

• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM
• Ubuntu 16.04 ESM
• Ubuntu 14.04 ESM

Packages

• redis - Persistent key-value database with network interface

Details

It was discovered that Redis incorrectly handled certain specially crafted
Lua scripts. A remote attacker could possibly use this issue to cause a
denial of service or execute arbitrary code. (CVE-2021-32626)

It was discovered that Redis incorrectly handled some malformed requests
when using Redis Lua Debugger. A remote attacker could possibly use this
issue to cause a denial of service or other unspecified impact. This issue
only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-32672)

It was discovered that Redis incorrectly handled certain Redis Standard
Protocol (RESP) requests. A remote attacker could possibly use this issue
to cause a denial of service. (CVE-2021-32675)

It was discovered that Redis incorrectly handled some configuration
parameters with specially crafted network payloads. A remote attacker
could possibly use this issue to cause a denial of service or execute
arbitrary code. Vulnerabilities CVE-2021-32627 and CVE-2021-41099
only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM.
(CVE-2021-32627, CVE-2021-32628, CVE-2021-32687, CVE-2021-41099).

It was discovered that Redis incorrectly handled memory when processing
certain input in 32-bit systems. A remote attacker could possibly use
this issue to cause a denial of service or execute arbitrary code.
One vulnerability (CVE-2021-32761) only affected Ubuntu 14.04 ESM,
Ubuntu 16.04 ESM and Ubuntu 18.04 ESM and another vulnerability
(CVE-2021-21309) only affected Ubuntu 18.04 ESM.
(CVE-2021-32761, CVE-2021-21309).

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 20.04

• redis - 5:5.0.7-2ubuntu0.1+esm1
  Available with Ubuntu Pro
• redis-tools - 5:5.0.7-2ubuntu0.1+esm1
  Available with Ubuntu Pro

Ubuntu 18.04

• redis - 5:4.0.9-1ubuntu0.2+esm3
  Available with Ubuntu Pro
• redis-tools - 5:4.0.9-1ubuntu0.2+esm3
  Available with Ubuntu Pro

Ubuntu 16.04

• redis-tools - 2:3.0.6-1ubuntu0.4+esm1
  Available with Ubuntu Pro
• redis-server - 2:3.0.6-1ubuntu0.4+esm1
  Available with Ubuntu Pro

Ubuntu 14.04

• redis-server - 2:2.8.4-2ubuntu0.2+esm2
  Available with Ubuntu Pro
• redis-tools - 2:2.8.4-2ubuntu0.2+esm2
  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References

• CVE-2021-41099
• CVE-2021-32672
• CVE-2021-32687
• CVE-2021-32628
• CVE-2021-32761
• CVE-2021-21309
• CVE-2021-32675
• CVE-2021-32627
• CVE-2021-32626