RHSA-2021:3947HighCVSS 7.5

Red Hat Security Advisory: rh-redis5-redis security update

Published
October 20, 2021
Last Modified
August 4, 2026

🔗 CVE IDs covered (6)

CVE-2021-41099 →CVE-2021-32626 →CVE-2021-32627 →CVE-2021-32628 →CVE-2021-32675 →CVE-2021-32687 →

📋 Description

CVE-2021-32626 — redis: Lua scripts can overflow the heap-based Lua stack CVE-2021-32627 — redis: Integer overflow issue with Streams CVE-2021-32628 — redis: Integer overflow bug in the ziplist data structure CVE-2021-32675 — redis: Denial of service via Redis Standard Protocol (RESP) request CVE-2021-32687 — redis: Integer overflow issue with intsets CVE-2021-41099 — redis: Integer overflow issue with strings

🎯 Affected products20

  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-redis5-redis-0:5.0.5-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-redis5-redis-0:5.0.5-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-redis5-redis-0:5.0.5-3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-redis5-redis-0:5.0.5-3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-redis5-redis-0:5.0.5-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-redis5-redis-0:5.0.5-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-redis5-redis-0:5.0.5-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-redis5-redis-0:5.0.5-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-redis5-redis-0:5.0.5-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-redis5-redis-0:5.0.5-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • rh-redis5-redis-debuginfo-0:5.0.5-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-redis5-redis-debuginfo-0:5.0.5-3.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-redis5-redis-debuginfo-0:5.0.5-3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-redis5-redis-debuginfo-0:5.0.5-3.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-redis5-redis-debuginfo-0:5.0.5-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • rh-redis5-redis-debuginfo-0:5.0.5-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • rh-redis5-redis-debuginfo-0:5.0.5-3.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands. Please see https://redis.io/topics/acl for more information on how to do this. Workaround: The flaw can be mitigated by disallowing usage of the CONFIG SET command via ACL configuration. This will prevent clients from setting the `proto-max-bulk-len` configuration parameter. Please see https://redis.io/topics/acl for more information on how to do this. Workaround: The flaw can be mitigated by disallowing usage of the CONFIG SET command via ACL configuration. This will prevent clients from setting the above configuration parameters. Please see https://redis.io/topics/acl for more information on how to do this. Workaround: Prevent unauthenticated users from connecting to Redis by using network access control tools (e.g., firewalls) or enabling TLS and requiring users to authenticate using client side certificates. Workaround: The flaw can be mitigated by disallowing usage of the CONFIG SET command via ACL configuration. This will prevent clients from setting the `set-max-intset-entries` configuration parameter. Please see https://redis.io/topics/acl for more information on how to do this.

🔗 References (9)