CVE-2021-3470
Last modified
CVE-2021-3470 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. A heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when using a heap allocator other than jemalloc or glibc's malloc, leading to potential out of bound write or process crash. Effectively this flaw does not affect the vast majority of users, who use jemalloc or glibc malloc.. EPSS estimates a 1.14% chance of exploitation in the next 30 days.
Description
A heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when using a heap allocator other than jemalloc or glibc's malloc, leading to potential out of bound write or process crash. Effectively this flaw does not affect the vast majority of users, who use jemalloc or glibc malloc.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Redislabs | Redis | < 5.0.10 | — |
| Redislabs | Redis | >= 6.0.0, < 6.0.9 | — |
| Redislabs | Redis | 6.2.0 | Rc1 |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1943623Issue Tracking, Patch, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1943623Issue Tracking, Patch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-3470?
How severe is CVE-2021-3470?
How do I fix CVE-2021-3470?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-34692iDrive RemotePC before 7.6.48 on Windows allows privilege es…7.8
- CVE-2021-34693net/can/bcm.c in the Linux kernel through 5.12.10 allows loc…5.5
- CVE-2021-34696A vulnerability in the access control list (ACL) programming…5.8
- CVE-2021-34697A vulnerability in the Protection Against Distributed Denial…8.6
- CVE-2021-34698A vulnerability in the proxy service of Cisco AsyncOS for Ci…7.5
- CVE-2021-34699A vulnerability in the TrustSec CLI parser of Cisco IOS and …7.7
- CVE-2021-34700A vulnerability in the CLI interface of Cisco SD-WAN vManage…5.5
- CVE-2021-34701A vulnerability in the web-based management interface of Cis…4.3
- CVE-2021-34702A vulnerability in the web-based management interface of Cis…4.3
- CVE-2021-34703A vulnerability in the Link Layer Discovery Protocol (LLDP) …6.5
- CVE-2021-34704A vulnerability in the web services interface of Cisco Adapt…7.5
- CVE-2021-34705A vulnerability in the Voice Telephony Service Provider (VTS…5.3
Are you affected by CVE-2021-3470?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST