onyx --cves cve-2021-32762
CVE-2021-32762
- score
- <0.1
- cvss
- 7.5
- epss
- 2.6%
- published
- 2021-10-04
- kev added
- —
- first seen
Redis versions prior to 6.2.6, 6.0.16, and 5.0.14 contain an integer overflow caused by the hiredis library when parsing large multi-bulk network replies, letting attackers potentially cause memory corruption, exploit requires sending crafted large replies.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 9
- https://github.com/redis/redis/security/advisories/GHSA-833w-8v3m-8wwr
- https://security.netapp.com/advisory/ntap-20211104-0003/
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/
- https://security.gentoo.org/glsa/202209-17
- https://www.debian.org/security/2021/dsa-5001
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/
- https://github.com/redis/redis/commit/0215324a66af949be39b34be2d55143232c1cb71