RHSA-2021:3971HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenStack Platform 10.0 (redis) security update

Published
October 25, 2021
Last Modified
August 4, 2026

🔗 CVE IDs covered (6)

CVE-2021-32687 →CVE-2021-41099 →CVE-2021-32626 →CVE-2021-32627 →CVE-2021-32628 →CVE-2021-32675 →

📋 Description

CVE-2021-32626 — redis: Lua scripts can overflow the heap-based Lua stack CVE-2021-32627 — redis: Integer overflow issue with Streams CVE-2021-32628 — redis: Integer overflow bug in the ziplist data structure CVE-2021-32675 — redis: Denial of service via Redis Standard Protocol (RESP) request CVE-2021-32687 — redis: Integer overflow issue with intsets CVE-2021-41099 — redis: Integer overflow issue with strings

🎯 Affected products4

  • Red Hat OpenStack Platform 10.0
  • redis-0:3.2.8-5.el7ost.src as a component of Red Hat OpenStack Platform 10.0
  • redis-0:3.2.8-5.el7ost.x86_64 as a component of Red Hat OpenStack Platform 10.0
  • redis-debuginfo-0:3.2.8-5.el7ost.x86_64 as a component of Red Hat OpenStack Platform 10.0

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands. Please see https://redis.io/topics/acl for more information on how to do this. Workaround: The flaw can be mitigated by disallowing usage of the CONFIG SET command via ACL configuration. This will prevent clients from setting the `proto-max-bulk-len` configuration parameter. Please see https://redis.io/topics/acl for more information on how to do this. Workaround: The flaw can be mitigated by disallowing usage of the CONFIG SET command via ACL configuration. This will prevent clients from setting the above configuration parameters. Please see https://redis.io/topics/acl for more information on how to do this. Workaround: Prevent unauthenticated users from connecting to Redis by using network access control tools (e.g., firewalls) or enabling TLS and requiring users to authenticate using client side certificates. Workaround: The flaw can be mitigated by disallowing usage of the CONFIG SET command via ACL configuration. This will prevent clients from setting the `set-max-intset-entries` configuration parameter. Please see https://redis.io/topics/acl for more information on how to do this.

🔗 References (9)