Zwei Probleme in redis
ID: | FEDORA-2021-0ad4bec5b1 |
Distribution: | Fedora |
Plattformen: | Fedora 33 |
Datum: | Fr, 11. Juni 2021, 07:11 |
Referenzen: | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29477
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32625 |
Applikationen: | Redis |
Originalnachricht |
|
-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2021-0ad4bec5b1 2021-06-11 01:18:48.291767 -------------------------------------------------------------------------------- Name : redis Product : Fedora 33 Version : 6.0.14 Release : 1.fc33 URL : https://redis.io Summary : A persistent key-value database Description : Redis is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Redis works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Redis also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Redis behave like a cache. You can use Redis from most programming languages also. -------------------------------------------------------------------------------- Update Information: **Redis 6.0.14** - Released Tue June 1 12:00:00 IST 2021 Upgrade urgency: SECURITY, Contains fixes to security issues that affect authenticated client connections. MODERATE otherwise. Fix integer overflow in STRALGO LCS (**CVE-2021-32625**) An integer overflow bug in Redis version 6.0 or newer can be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477. Other bug fixes: * Fix crash in UNLINK on a stream key with deleted consumer groups (#8932) * SINTERSTORE: Add missing keyspace del event when none of the sources exist (#8949) -------------------------------------------------------------------------------- ChangeLog: * Wed Jun 2 2021 Remi Collet |