http://bugzilla.opensuse.org/show_bug.cgi?id=1191305 Bug ID: 1191305 Summary: VUL-0: CVE-2021-32627,CVE-2021-32628: redis: Integer to heap buffer overflows Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: danilo.spinella@suse.com Reporter: Andreas.Stieger@gmx.de QA Contact: security-team@suse.de Found By: Security Response Team Blocker: --- Fixed in Redis 6.2.6, 6.0.16 and 5.0.14 CVE-2021-32627: Integer to heap buffer overflow issue with streams, when configuring a non-default, large value for proto-max-bulk-len and client-query-buffer-limit CVE-2021-32628: Integer to heap buffer overflow handling ziplist-encoded data types, when configuring a large, non-default value for hash-max-ziplist-entries, hash-max-ziplist-value, zset-max-ziplist-entries or zset-max-ziplist-value References: https://github.com/redis/redis/commit/2775a3526e3e8bb040e72995231632c8019773... https://groups.google.com/g/redis-db/c/GS_9L2KCk9g/m/Q7ZN1R1cDAAJ -- You are receiving this mail because: You are on the CC list for the bug.