CVE-2021-3470: Buffer Overflow
First published: Fri Mar 26 2021(Updated: )
A heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when using a heap allocator other than jemalloc or glibc's malloc, leading to potential out of bound write or process crash. Effectively this flaw does not affect the vast majority of users, who use jemalloc or glibc malloc.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Redislabs Redis | <5.0.10 | |
| Redislabs Redis | >=6.0.0<6.0.9 | |
| Redislabs Redis | =6.2.0-rc1 | |
| Redislabs Redis | =6.2.0-rc2 | |
| Redislabs Redis | =6.2.0-rc3 | |
| redhat/redis | <5.0.10 | 5.0.10 |
| redhat/redis | <6.0.9 | 6.0.9 |
| redhat/redis | <6.2.0 | 6.2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=1943623
- https://github.com/redis/redis/pull/7963
- https://github.com/redis/redis/commit/9824fe3e392caa04dc1b4071886e9ac402dd6d95
- https://raw.githubusercontent.com/redis/redis/5.0.10/00-RELEASENOTES
- https://raw.githubusercontent.com/redis/redis/6.0.9/00-RELEASENOTES
- https://github.com/redis/redis#allocator
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1948769
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1948770
Frequently Asked Questions
What is CVE-2021-3470?
CVE-2021-3470 is a heap overflow issue found in Redis in versions before 5.0.10, before 6.0.9, and before 6.2.0 when using a heap allocator other than jemalloc or glibc's malloc.
What is the severity of CVE-2021-3470?
The severity of CVE-2021-3470 is medium with a severity value of 5.3.
Which software versions are affected by CVE-2021-3470?
Redis versions before 5.0.10, before 6.0.9, and before 6.2.0 are affected by CVE-2021-3470.
How does CVE-2021-3470 affect Redis users?
CVE-2021-3470 does not affect the vast majority of Redis users who use jemalloc as their heap allocator.
Where can I find more information about CVE-2021-3470?
You can find more information about CVE-2021-3470 at the following link: https://bugzilla.redhat.com/show_bug.cgi?id=1943623
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/remedy
- agent/author
- agent/last-modified-date
- agent/references
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-3470
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- agent/trending
- vendor/redislabs
- canonical/redislabs redis
- version/redislabs redis/6.0.0
- version/redislabs redis/6.2.0-rc1
- version/redislabs redis/6.2.0-rc2
- version/redislabs redis/6.2.0-rc3
- package-manager/redhat