RHSA-2021:3945HighCVSS 7.5

Red Hat Security Advisory: redis:6 security update

Published
October 20, 2021
Last Modified
August 4, 2026

🔗 CVE IDs covered (6)

CVE-2021-32675 →CVE-2021-32687 →CVE-2021-41099 →CVE-2021-32626 →CVE-2021-32627 →CVE-2021-32628 →

📋 Description

CVE-2021-32626 — redis: Lua scripts can overflow the heap-based Lua stack CVE-2021-32627 — redis: Integer overflow issue with Streams CVE-2021-32628 — redis: Integer overflow bug in the ziplist data structure CVE-2021-32675 — redis: Denial of service via Redis Standard Protocol (RESP) request CVE-2021-32687 — redis: Integer overflow issue with intsets CVE-2021-41099 — redis: Integer overflow issue with strings

🎯 Affected products19

  • Red Hat Enterprise Linux AppStream (v. 8)
  • redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64 (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.src (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64 (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64 (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-debuginfo-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64 (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64 (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-debugsource-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64 (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.aarch64 (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.ppc64le (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.s390x (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-devel-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.x86_64 (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • redis-doc-0:6.0.9-5.module+el8.4.0+12929+1bb0d2aa.noarch (redis:6) as a component of Red Hat Enterprise Linux AppStream (v. 8)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands. Please see https://redis.io/topics/acl for more information on how to do this. Workaround: The flaw can be mitigated by disallowing usage of the CONFIG SET command via ACL configuration. This will prevent clients from setting the `proto-max-bulk-len` configuration parameter. Please see https://redis.io/topics/acl for more information on how to do this. Workaround: The flaw can be mitigated by disallowing usage of the CONFIG SET command via ACL configuration. This will prevent clients from setting the above configuration parameters. Please see https://redis.io/topics/acl for more information on how to do this. Workaround: Prevent unauthenticated users from connecting to Redis by using network access control tools (e.g., firewalls) or enabling TLS and requiring users to authenticate using client side certificates. Workaround: The flaw can be mitigated by disallowing usage of the CONFIG SET command via ACL configuration. This will prevent clients from setting the `set-max-intset-entries` configuration parameter. Please see https://redis.io/topics/acl for more information on how to do this.

🔗 References (9)