onyx --cves cve-2021-32687
CVE-2021-32687
- score
- <0.1
- cvss
- 7.5
- epss
- 4.1%
- published
- 2021-10-04
- kev added
- —
- first seen
Redis versions 5.0.14, 6.0.16, and 6.2.6 contain an integer overflow caused by manipulating the set-max-intset-entries configuration parameter, letting attackers corrupt heap or execute remote code, exploit requires changing the parameter to a large value and crafting specific commands.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 9
- https://github.com/redis/redis/commit/a30d367a71b7017581cf1ca104242a3c644dec0f
- https://github.com/redis/redis/security/advisories/GHSA-m3mf-8x9w-r27q
- https://security.netapp.com/advisory/ntap-20211104-0003/
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/
- https://security.gentoo.org/glsa/202209-17
- https://www.debian.org/security/2021/dsa-5001