CVE-2021-29478

Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets.

Security Fix(es):

Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis 6.2 before 6.2.3 could be exploited to corrupt the heap and potentially result with remote code execution. Redis 6.0 and earlier are not directly affected by this issue. The problem is fixed in version 6.2.3. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the set-max-intset-entries configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.(CVE-2021-29478)

An integer overflow bug in Redis version 6.0 or newer could be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution (CVE-2021-29477).

An integer overflow bug in Redis 6.2 before 6.2.3 could be exploited to corrupt the heap and potentially result with remote code execution (CVE-2021-29478).

A vulnerability involving out-of-bounds read and integer overflow to buffer overflow exists starting with version 2.2 and prior to versions 5.0.13, 6.0.15 and 6.2.5. On 32-bit systems, Redis *BIT* command are vulnerable to integer overflow that can potentially be exploited to corrupt the heap, leak arbitrary heap contents or trigger remote code execution (CVE-2021-32761).

This update for redis fixes the following issues:

redis 6.0.13

• CVE-2021-29477: Integer overflow in STRALGO LCS command (boo#1185729)
• CVE-2021-29478: Integer overflow in COPY command for large intsets (boo#1185730)
• Cluster: Skip unnecessary check which may prevent failure detection
• Fix performance regression in BRPOP on Redis 6.0
• Fix edge-case when a module client is unblocked

redis 6.0.12:

• Fix compilation error on non-glibc systems if jemalloc is not used

redis 6.0.11:

• CVE-2021-21309: Avoid 32-bit overflows when proto-max-bulk-len is set high (boo#1182657)
• Fix handling of threaded IO and CLIENT PAUSE (failover), could lead to data loss or a crash
• Fix the selection of a random element from large hash tables
• Fix broken protocol in client tracking tracking-redir-broken message
• XINFO able to access expired keys on a replica
• Fix broken protocol in redis-benchmark when used with -a or --dbnum
• Avoid assertions (on older kernels) when testing arm64 CoW bug
• CONFIG REWRITE should honor umask settings
• Fix firstkey,lastkey,step in COMMAND command for some commands
• RM_ZsetRem: Delete key if empty, the bug could leave empty zset keys

redis 6.0.10:

Command behavior changes:

• SWAPDB invalidates WATCHed keys (#8239)
• SORT command behaves differently when used on a writable replica (#8283)
• EXISTS should not alter LRU (#8016) In Redis 5.0 and 6.0 it would have touched the LRU/LFU of the key.
• OBJECT should not reveal logically expired keys (#8016) Will now behave the same TYPE or any other non-DEBUG command.
• GEORADIUS[BYMEMBER] can fail with -OOM if Redis is over the memory limit (#8107)

Other behavior changes:

• Sentinel: Fix missing updates to the config file after SENTINEL SET command (#8229)
• CONFIG REWRITE is atomic and safer, but requires write access to the config file's folder (#7824, #8051) This change was already present in 6.0.9, but was missing from the release notes.

Bug fixes with compatibility implications (bugs introduced in Redis 6.0):

• Fix RDB CRC64 checksum on big-endian systems (#8270) If you're using big-endian please consider the compatibility implications with RESTORE, replication and persistence.
• Fix wrong order of key/value in Lua's map response (#8266) If your scripts use redis.setresp() or return a map (new in Redis 6.0), please consider the implications.

Bug fixes:

• Fix an issue where a forked process deletes the parent's pidfile (#8231)
• Fix crashes when enabling io-threads-do-reads (#8230)
• Fix a crash in redis-cli after executing cluster backup (#8267)
• Handle output buffer limits for module blocked clients (#8141) Could result in a module sending reply to a blocked client to go beyond the limit.
• Fix setproctitle related crashes. (#8150, #8088) Caused various crashes on startup, mainly on Apple M1 chips or under instrumentation.
• Backup/restore cluster mode keys to slots map for repl-diskless-load=swapdb (#8108) In cluster mode with repl-diskless-load, when loading failed, slot map wouldn't have been restored.
• Fix oom-score-adj-values range, and bug when used in config file (#8046) Enabling setting this in the config file in a line after enabling it, would have been buggy.
• Reset average ttl when empty databases (#8106) Just causing misleading metric in INFO
• Disable rehash when Redis has child process (#8007) This could have caused excessive CoW during BGSAVE, replication or AOFRW.
• Further improved ACL algorithm for picking categories (#7966) Output of ACL GETUSER is now more similar to the one provided by ACL SETUSER.
• Fix bug with module GIL being released prematurely (#8061) Could in theory (and rarely) cause multi-threaded modules to corrupt memory.
• Reduce effect of client tracking causing feedback loop in key eviction (#8100)
• Fix cluster access to unaligned memory (SIGBUS on old ARM) (#7958)
• Fix saving of strings larger than 2GB into RDB files (#8306)

Additional improvements:

• Avoid…

These are all security issues fixed in the redis-6.2.5-1.2 package on the GA media of openSUSE Tumbleweed.

This update for redis fixes the following issues:

redis was updated to 6.0.13:

• CVE-2021-29477: Integer overflow in STRALGO LCS command (bsc#1185729)
• CVE-2021-29478: Integer overflow in COPY command for large intsets (bsc#1185730)
• Cluster: Skip unnecessary check which may prevent failure detection
• Fix performance regression in BRPOP on Redis 6.0
• Fix edge-case when a module client is unblocked

redis 6.0.12:

• Fix compilation error on non-glibc systems if jemalloc is not used

redis 6.0.11:

• CVE-2021-21309: Avoid 32-bit overflows when proto-max-bulk-len is set high (bsc#1182657)
• Fix handling of threaded IO and CLIENT PAUSE (failover), could lead to data loss or a crash
• Fix the selection of a random element from large hash tables
• Fix broken protocol in client tracking tracking-redir-broken message
• XINFO able to access expired keys on a replica
• Fix broken protocol in redis-benchmark when used with -a or --dbnum
• Avoid assertions (on older kernels) when testing arm64 CoW bug
• CONFIG REWRITE should honor umask settings
• Fix firstkey,lastkey,step in COMMAND command for some commands
• RM_ZsetRem: Delete key if empty, the bug could leave empty zset keys

• Switch systemd type of the sentinel service from notify to simple. This can be reverted when updating to 6.2 which fixes https://github.com/redis/redis/issues/7284 .