CVE-2021-3470

Name	CVE-2021-3470
Description	A heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when using a heap allocator other than jemalloc or glibc's malloc, leading to potential out of bound write or process crash. Effectively this flaw does not affect the vast majority of users, who use jemalloc or glibc malloc.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
redis (PTS)	bullseye	5:6.0.16-1+deb11u2	fixed
	bullseye (security)	5:6.0.16-1+deb11u4	fixed
	bookworm, bookworm (security)	5:7.0.15-1~deb12u1	fixed
	sid, trixie	5:7.0.15-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
redis	source	(unstable)	5:6.0.9-1	unimportant

Notes

https://github.com/redis/redis/pull/7963
https://github.com/redis/redis/commit/9824fe3e392caa04dc1b4071886e9ac402dd6d95
Only an issue if not using a heap allocator other than jemalloc or glibc's malloc