CVE-2021-32687

Name of the Vulnerable Software and Affected Versions Redis versions prior to 5.0.14 Redis versions prior to 6.0.16 Redis versions prior to 6.2.6

Description The issue is related to an integer overflow bug in Redis that can be exploited to corrupt the heap and potentially trigger remote code execution. This can be achieved by changing the default set-max-intset-entries configuration parameter to a very large value and constructing specially crafted commands to manipulate sets.

Recommendations For versions prior to 5.0.14, update to version 5.0.14 or later. For versions prior to 6.0.16, update to version 6.0.16 or later. For versions prior to 6.2.6, update to version 6.2.6 or later. As a temporary workaround, consider restricting unprivileged users from using the CONFIG SET command to prevent modification of the set-max-intset-entries configuration parameter, which can be done using ACL.