Cyber Resilience

CVE-2021-32672

Medium

Published: 04 October 2021

Published
04 October 2021
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0028 52.1th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-32672 is a medium-severity Out-of-bounds Read (CWE-125) vulnerability in Redis Redis. Its CVSS base score is 5.3 (Medium).

Operationally, ranked in the top 47.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Redis is an open source, in-memory database that persists on disk. When using the Redis Lua Debugger, users can send malformed requests that cause the debugger’s protocol parser to read data beyond the actual buffer. This issue affects all versions…

more

of Redis with Lua debugging support (3.2 or newer). The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14.

CWE(s)
CWE-125

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

redis
redis
3.2.0 — 5.0.14 · 6.0.0 — 6.0.16 · 6.2.0 — 6.2.6
redhat
software collections
all versions
redhat
enterprise linux
8.0
debian
debian linux
10.0, 11.0
fedoraproject
fedora
33, 34, 35
netapp
management services for element software
all versions
netapp
management services for netapp hci
all versions
oracle
communications operations monitor
4.3, 4.4, 5.0

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References