onyx --cves cve-2021-32672
CVE-2021-32672
- score
- <0.1
- cvss
- 5.3
- epss
- 1.7% ▼0.1
- published
- 2021-10-04
- kev added
- —
- first seen
Redis 3.2 and newer with Lua debugging support contains a buffer over-read caused by malformed requests in the debugger's protocol parser, letting attackers read data beyond the buffer, exploit requires sending crafted requests.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 9
- https://security.gentoo.org/glsa/202209-17
- https://security.netapp.com/advisory/ntap-20211104-0003/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/
- https://github.com/redis/redis/commit/6ac3c0b7abd35f37201ed2d6298ecef4ea1ae1dd
- https://www.debian.org/security/2021/dsa-5001
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/
- https://github.com/redis/redis/security/advisories/GHSA-9mj9-xx53-qmxm