RHSA-2021:3946HighCVSS 7.5

Red Hat Security Advisory: redis:5 security update

Published
October 20, 2021
Last Modified
August 4, 2026

🔗 CVE IDs covered (6)

CVE-2021-41099 →CVE-2021-32626 →CVE-2021-32627 →CVE-2021-32628 →CVE-2021-32675 →CVE-2021-32687 →

📋 Description

CVE-2021-32626 — redis: Lua scripts can overflow the heap-based Lua stack CVE-2021-32627 — redis: Integer overflow issue with Streams CVE-2021-32628 — redis: Integer overflow bug in the ziplist data structure CVE-2021-32675 — redis: Denial of service via Redis Standard Protocol (RESP) request CVE-2021-32687 — redis: Integer overflow issue with intsets CVE-2021-41099 — redis: Integer overflow issue with strings

🎯 Affected products19

  • Red Hat Enterprise Linux AppStream EUS (v. 8.1)
  • redis-0:5.0.3-5.module+el8.1.0+12925+6460abef.aarch64 (redis:5) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)
  • redis-0:5.0.3-5.module+el8.1.0+12925+6460abef.ppc64le (redis:5) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)
  • redis-0:5.0.3-5.module+el8.1.0+12925+6460abef.s390x (redis:5) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)
  • redis-0:5.0.3-5.module+el8.1.0+12925+6460abef.src (redis:5) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)
  • redis-0:5.0.3-5.module+el8.1.0+12925+6460abef.x86_64 (redis:5) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)
  • redis-debuginfo-0:5.0.3-5.module+el8.1.0+12925+6460abef.aarch64 (redis:5) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)
  • redis-debuginfo-0:5.0.3-5.module+el8.1.0+12925+6460abef.ppc64le (redis:5) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)
  • redis-debuginfo-0:5.0.3-5.module+el8.1.0+12925+6460abef.s390x (redis:5) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)
  • redis-debuginfo-0:5.0.3-5.module+el8.1.0+12925+6460abef.x86_64 (redis:5) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)
  • redis-debugsource-0:5.0.3-5.module+el8.1.0+12925+6460abef.aarch64 (redis:5) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)
  • redis-debugsource-0:5.0.3-5.module+el8.1.0+12925+6460abef.ppc64le (redis:5) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)
  • redis-debugsource-0:5.0.3-5.module+el8.1.0+12925+6460abef.s390x (redis:5) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)
  • redis-debugsource-0:5.0.3-5.module+el8.1.0+12925+6460abef.x86_64 (redis:5) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)
  • redis-devel-0:5.0.3-5.module+el8.1.0+12925+6460abef.aarch64 (redis:5) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)
  • redis-devel-0:5.0.3-5.module+el8.1.0+12925+6460abef.ppc64le (redis:5) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)
  • redis-devel-0:5.0.3-5.module+el8.1.0+12925+6460abef.s390x (redis:5) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)
  • redis-devel-0:5.0.3-5.module+el8.1.0+12925+6460abef.x86_64 (redis:5) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)
  • redis-doc-0:5.0.3-5.module+el8.1.0+12925+6460abef.noarch (redis:5) as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands. Please see https://redis.io/topics/acl for more information on how to do this. Workaround: The flaw can be mitigated by disallowing usage of the CONFIG SET command via ACL configuration. This will prevent clients from setting the `proto-max-bulk-len` configuration parameter. Please see https://redis.io/topics/acl for more information on how to do this. Workaround: The flaw can be mitigated by disallowing usage of the CONFIG SET command via ACL configuration. This will prevent clients from setting the above configuration parameters. Please see https://redis.io/topics/acl for more information on how to do this. Workaround: Prevent unauthenticated users from connecting to Redis by using network access control tools (e.g., firewalls) or enabling TLS and requiring users to authenticate using client side certificates. Workaround: The flaw can be mitigated by disallowing usage of the CONFIG SET command via ACL configuration. This will prevent clients from setting the `set-max-intset-entries` configuration parameter. Please see https://redis.io/topics/acl for more information on how to do this.

🔗 References (9)