Vulnerability Name:

CVE-2021-32626 (CCN-210723)

Assigned:2021-10-04
Published:2021-10-04
Updated:2022-10-06
Summary:Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can cause the heap-based Lua stack to be overflowed, due to incomplete checks for this condition. This can result with heap corruption and potentially remote code execution. This problem exists in all versions of Redis with Lua scripting support, starting from 2.6. The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14. For users unable to update an additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
CVSS v3 Severity:8.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
7.7 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
6.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
7.5 High (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
6.5 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:6.5 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.1 High (CCN CVSS v2 Vector: AV:N/AC:H/Au:S/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-787
CWE-122
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2021-32626

Source: XF
Type: UNKNOWN
redis-cve202132626-bo(210723)

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/redis/redis/commit/666ed7facf4524bf6d19b11b20faa2cf93fdf591

Source: CCN
Type: Redis GIT Repository
Lua scripts can overflow the heap-based Lua stack

Source: CONFIRM
Type: Third Party Advisory
https://github.com/redis/redis/security/advisories/GHSA-p486-xggp-782c

Source: MLIST
Type: Mailing List, Third Party Advisory
[druid-commits] 20211025 [GitHub] [druid] jihoonson opened a new pull request #11844: Bump netty4 to 4.1.68; suppress CVE-2021-37136 and CVE-2021-37137 for netty3

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2021-61c487f241

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2021-8913c7900c

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2021-aa94492a09

Source: GENTOO
Type: Third Party Advisory
GLSA-202209-17

Source: CONFIRM
Type: Third Party Advisory
https://security.netapp.com/advisory/ntap-20211104-0003/

Source: DEBIAN
Type: Third Party Advisory
DSA-5001

Source: CCN
Type: IBM Security Bulletin 6523748 (Event Streams)
Multiple vulnerabilities in Redis affecting the IBM Event Streams UI

Source: CCN
Type: IBM Security Bulletin 6524682 (Spectrum Protect Plus)
Vulnerabilities in Redis, OpenSSH, Golang Go, and Apache Kafka may affect IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes and OpenShift

Source: CCN
Type: IBM Security Bulletin 6587098 (DataPower Gateway)
IBM DataPower Gateway: Update Redis to remediate two CVEs

Source: CCN
Type: IBM Security Bulletin 6597535 (Watson Knowledge Catalog on-prem)
Mutiple Vulnerabilities in Redis affecting Watson Knowledge Catalog for IBM Cloud Pak for Data

Source: CCN
Type: IBM Security Bulletin 6599643 (Cloud Pak for Multicloud Management Monitoring)
IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to various attacks due to its use of redis (CVE-2021-32675, CVE-2021-32626, CVE-2021-32672)

Source: CCN
Type: IBM Security Bulletin 6825987 (Robotic Process Automation)
Multiple security vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak

Source: CCN
Type: IBM Security Bulletin 7006571 (Robotic Process Automation for Cloud Pak)
Multiple vulnerabilities in Redis may affect IBM Robotic Process Automation for Cloud Pak

Source: CCN
Type: Oracle CPUApr2022
Oracle Critical Patch Update Advisory - April 2022

Source: MISC
Type: Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html

Vulnerable Configuration:Configuration 1:
  • cpe:/a:redis:redis:*:*:*:*:*:*:*:* (Version >= 6.2.0 and < 6.2.6)
  • OR cpe:/a:redis:redis:*:*:*:*:*:*:*:* (Version >= 6.0.0 and < 6.0.16)
  • OR cpe:/a:redis:redis:*:*:*:*:*:*:*:* (Version >= 2.6 and < 5.0.14)

    • Configuration 2:
  • cpe:/o:fedoraproject:fedora:33:*:*:*:*:*:*:*
  • OR cpe:/o:fedoraproject:fedora:34:*:*:*:*:*:*:*
  • OR cpe:/o:fedoraproject:fedora:35:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*
  • OR cpe:/a:netapp:management_services_for_netapp_hci:-:*:*:*:*:*:*:*

    • Configuration 4:
  • cpe:/o:debian:debian_linux:10.0:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:11.0:*:*:*:*:*:*:*

    • Configuration 5:
  • cpe:/a:oracle:communications_operations_monitor:4.3:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:communications_operations_monitor:4.4:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:communications_operations_monitor:5.0:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:redislabs:redis:*:*:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:datapower_gateway:2018.4.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:spectrum_protect_plus:10.1.5:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:event_streams:2019.4.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:spectrum_protect_plus:10.1.6:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:event_streams:2019.4.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:event_streams:10.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:event_streams:2019.4.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:event_streams:10.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:datapower_gateway:10.0.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:spectrum_protect_plus:10.1.7:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:event_streams:10.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:spectrum_protect_plus:10.1.8:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:datapower_gateway:10.0.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:event_streams:10.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:event_streams:10.3.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:robotic_process_automation:21.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:datapower_gateway:10.0.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:robotic_process_automation:21.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:robotic_process_automation:21.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:robotic_process_automation:21.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:robotic_process_automation_for_cloud_pak:21.0.1:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:8004
    P
    		dom4j-1.6.1-150200.12.6.3 on GA media (Moderate)
    2023-06-20
    oval:org.opensuse.security:def:8069
    P
    		velocity-1.7-150200.3.7.3 on GA media (Moderate)
    2023-06-20
    oval:org.opensuse.security:def:3519
    P
    		gv-3.7.4-1.36 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:95149
    P
    		redis-6.2.6-150400.1.5 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:113332
    P
    		redis-6.2.6-1.1 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:69093
    P
    		Security update for redis (Important)
    2021-11-23
    oval:org.opensuse.security:def:102222
    P
    		Security update for redis (Important)
    2021-11-23
    oval:org.opensuse.security:def:109441
    P
    		Security update for redis (Important)
    2021-11-23
    oval:org.opensuse.security:def:118537
    P
    		Security update for redis (Important)
    2021-11-23
    oval:org.opensuse.security:def:69158
    P
    		Security update for redis (Important)
    2021-11-23
    oval:org.opensuse.security:def:1646
    P
    		Security update for redis (Important)
    2021-11-23
    oval:org.opensuse.security:def:96085
    P
    		Security update for redis (Important)
    2021-11-23
    oval:org.opensuse.security:def:111795
    P
    		Security update for redis (Important)
    2021-11-23
    oval:org.opensuse.security:def:102775
    P
    		Security update for redis (Important)
    2021-11-23
    oval:com.redhat.rhsa:def:20213945
    P
    		RHSA-2021:3945: redis:6 security update (Important)
    2021-10-20
    oval:com.redhat.rhsa:def:20213918
    P
    		RHSA-2021:3918: redis:5 security update (Important)
    2021-10-19
    BACK
    redis redis *
    redis redis *
    redis redis *
    fedoraproject fedora 33
    fedoraproject fedora 34
    fedoraproject fedora 35
    netapp management services for element software -
    netapp management services for netapp hci -
    debian debian linux 10.0
    debian debian linux 11.0
    oracle communications operations monitor 4.3
    oracle communications operations monitor 4.4
    oracle communications operations monitor 5.0
    redislabs redis *
    ibm datapower gateway 2018.4.1.0
    ibm spectrum protect plus 10.1.5
    ibm event streams 2019.4.1
    ibm spectrum protect plus 10.1.6
    ibm event streams 2019.4.2
    ibm event streams 10.0.0
    ibm event streams 2019.4.3
    ibm event streams 10.1.0
    ibm datapower gateway 10.0.1.0
    ibm spectrum protect plus 10.1.7
    ibm event streams 10.2.0
    ibm spectrum protect plus 10.1.8
    ibm datapower gateway 10.0.2.0
    ibm event streams 10.3.0
    ibm event streams 10.3.1
    ibm robotic process automation 21.0.0
    ibm datapower gateway 10.0.3.0
    ibm robotic process automation 21.0.1
    ibm robotic process automation 21.0.2
    ibm robotic process automation 21.0.3
    ibm robotic process automation for cloud pak 21.0.1