Arch Linux Security Advisory ASA-202106-12 ========================================== Severity: High Date : 2021-06-01 CVE-ID : CVE-2021-32625 Package : redis Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2022 Summary ======= The package redis before version 6.2.4-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 6.2.4-1. # pacman -Syu "redis>=6.2.4-1" The problem has been fixed upstream in version 6.2.4. Workaround ========== A workaround to mitigate the problem is to use an ACL configuration to prevent clients from using the STRALGO LCS command. On systems running Redis version 6.2.3, it is sufficient to make sure that the proto-max-bulk-len config parameter is smaller than 2GB (default is 512MB). Description =========== An integer overflow bug in Redis versions 6.0 up to 6.2.3 can be exploited using the STRALGO LCS command to corrupt the heap and potentially result in remote code execution. This is a result of an incomplete fix of CVE-2021-29477. Impact ====== A remote attacker could execute arbitrary code on the database server through a crafted STRALGO LCS command. References ========== https://github.com/redis/redis/security/advisories/GHSA-46cp-x4x9-6pfq https://github.com/redis/redis/pull/9011 https://github.com/redis/redis/pull/9019 https://github.com/redis/redis/commit/e9a1438ac4c52aa68dfa2a8324b64193568421... https://security.archlinux.org/CVE-2021-32625