CVE-2021-3470

NameCVE-2021-3470
DescriptionA heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when using a heap allocator other than jemalloc or glibc's malloc, leading to potential out of bound write or process crash. Effectively this flaw does not affect the vast majority of users, who use jemalloc or glibc malloc.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
redis (PTS)stretch3:3.2.6-3+deb9u3vulnerable
stretch (security)3:3.2.6-3+deb9u4vulnerable
buster5:5.0.3-4+deb10u3vulnerable
buster (security)5:5.0.3-4+deb10u2vulnerable
bullseye5:6.0.11-1fixed
sid5:6.0.12-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
redissource(unstable)5:6.0.9-1unimportant

Notes

https://github.com/redis/redis/pull/7963
https://github.com/redis/redis/commit/9824fe3e392caa04dc1b4071886e9ac402dd6d95
Only an issue if not using a heap allocator other than jemalloc or glibc's malloc

Search for package or bug name: Reporting problems