CVE-2021-3470

NameCVE-2021-3470
DescriptionA heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when using a heap allocator other than jemalloc or glibc's malloc, leading to potential out of bound write or process crash. Effectively this flaw does not affect the vast majority of users, who use jemalloc or glibc malloc.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
redis (PTS)buster, buster (security)5:5.0.14-1+deb10u2vulnerable
bullseye (security), bullseye5:6.0.16-1+deb11u2fixed
bookworm, sid5:7.0.5-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
redissource(unstable)5:6.0.9-1unimportant

Notes

https://github.com/redis/redis/pull/7963
https://github.com/redis/redis/commit/9824fe3e392caa04dc1b4071886e9ac402dd6d95
Only an issue if not using a heap allocator other than jemalloc or glibc's malloc

Search for package or bug name: Reporting problems