
http://bugzilla.opensuse.org/show_bug.cgi?id=1186722 Bug ID: 1186722 Summary: VUL-0: CVE-2021-32625: redis: integer overflow in STRALGO LCS Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.2 Hardware: Other OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: security-team@suse.de Reporter: Andreas.Stieger@gmx.de QA Contact: qa-bugs@suse.de CC: amajer@suse.com, kstreitova@suse.com, michael@stroeder.com, michal.hrusecky@opensuse.org, mpluskal@suse.com, security-team@suse.de Found By: Security Response Team Blocker: --- An integer overflow bug in Redis version 6.0 or newer can be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477. master: https://github.com/redis/redis/commit/1ddecf1958924b178b76a31d989ef1e05af819... 6.2.x: https://github.com/redis/redis/commit/e9a1438ac4c52aa68dfa2a8324b64193568421... 6.0.x: https://github.com/redis/redis/commit/dd27c4e15ee54251093c5895d3681c3894d2b6... References: https://raw.githubusercontent.com/redis/redis/6.2/00-RELEASENOTES -- You are receiving this mail because: You are on the CC list for the bug.