p PatchFirst

CVE-2021-32672

CVE-2021-32672 · Vulnerability in Lua Debugger in Redis

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Redis is an open source, in-memory database that persists on disk. When using the Redis Lua Debugger, users can send malformed requests that cause the debugger’s protocol parser to read data beyond the actual buffer. This issue affects all versions of Redis with Lua debugging support (3.2 or newer). The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14.

CVSS 5.3 · Medium · EPSS 1.7% · Fix available

Published
Updated

Stack: system · database

Affected products and versions

  • redis

    Versions
    • >= 3.2.0, < 5.0.14: Affected
    • >= 6.0.0, < 6.0.16: Affected
    • >= 6.0.0, < 6.2.6: Affected

    No fix published

  • redis Debian:12

    Affected ranges
    • ECOSYSTEM: < 5:6.0.16-1

    Update to 5:6.0.16-1

  • redis Debian:13

    Affected ranges
    • ECOSYSTEM: < 5:6.0.16-1

    Update to 5:6.0.16-1

  • redis Debian:14

    Affected ranges
    • ECOSYSTEM: < 5:6.0.16-1

    Update to 5:6.0.16-1

  • redis Ubuntu:Pro:18.04:LTS

    Versions
    • 4:4.0.1-7
    • 4:4.0.2-6
    • 4:4.0.2-9
    • 5:4.0.5-1
    • 5:4.0.6-1
    • 5:4.0.6-2
    • 5:4.0.7-1
    • 5:4.0.8-1
    • 5:4.0.8-2
    • 5:4.0.9-1
    • 5:4.0.9-1ubuntu0.1
    • 5:4.0.9-1ubuntu0.2
    • 5:4.0.9-1ubuntu0.2+esm2
    Affected ranges
    • ECOSYSTEM: < 5:4.0.9-1ubuntu0.2+esm3

    Update to 5:4.0.9-1ubuntu0.2+esm3

  • redis Ubuntu:Pro:20.04:LTS

    Versions
    • 5:5.0.5-2build1
    • 5:5.0.6-1
    • 5:5.0.7-1
    • 5:5.0.7-2
    • 5:5.0.7-2ubuntu0.1~esm1
    • 5:5.0.7-2ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 5:5.0.7-2ubuntu0.1+esm1

    Update to 5:5.0.7-2ubuntu0.1+esm1

Original sources

Check your server →