CVE-2021-32675 (CNNVD-202110-137)
中文标题:
Redis Labs Redis 安全漏洞
英文标题:
DoS vulnerability in Redis
漏洞描述
中文描述:
Redis Labs Redis是美国Redis Labs公司的一套开源的使用ANSI C编写、支持网络、可基于内存亦可持久化的日志型、键值（Key-Value）存储数据库，并提供多种语言的API。 Redis 存在安全漏洞，当解析一个传入的Redis Standard Protocol (RESP)请求时，Redis根据用户指定的值来分配内存，这些值决定了多个bulk报头中的元素数量和每个元素的大小(bulk报头)。攻击者可利用该漏洞通过多个连接传递特别设计的请求可能会导致服务器分配大量内存。
英文描述:
Redis is an open source, in-memory database that persists on disk. When parsing an incoming Redis Standard Protocol (RESP) request, Redis allocates memory according to user-specified values which determine the number of elements (in the multi-bulk header) and size of each element (in the bulk header). An attacker delivering specially crafted requests over multiple connections can cause the server to allocate significant amount of memory. Because the same parsing mechanism is used to handle authentication requests, this vulnerability can also be exploited by unauthenticated users. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. An additional workaround to mitigate this problem without patching the redis-server executable is to block access to prevent unauthenticated users from connecting to Redis. This can be done in different ways: Using network access control tools like firewalls, iptables, security groups, etc. or Enabling TLS and requiring users to authenticate using client side certificates.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| redis | redis | < 5.0.14 | - | - |
cpe:2.3:a:redis:redis:<_5.0.14:*:*:*:*:*:*:*
|
| redis | redis | >= 6.0.0, < 6.0.16 | - | - |
cpe:2.3:a:redis:redis:>=_6.0.0,_<_6.0.16:*:*:*:*:*:*:*
|
| redis | redis | >= 6.2.0, < 6.2.6 | - | - |
cpe:2.3:a:redis:redis:>=_6.2.0,_<_6.2.6:*:*:*:*:*:*:*
|
| redis | redis | * | - | - |
cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*
|
| fedoraproject | fedora | 33 | - | - |
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
|
| fedoraproject | fedora | 34 | - | - |
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
|
| fedoraproject | fedora | 35 | - | - |
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
|
| debian | debian_linux | 10.0 | - | - |
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
|
| debian | debian_linux | 11.0 | - | - |
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
|
| netapp | management_services_for_element_software | - | - | - |
cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*
|
| netapp | management_services_for_netapp_hci | - | - | - |
cpe:2.3:a:netapp:management_services_for_netapp_hci:-:*:*:*:*:*:*:*
|
| oracle | communications_operations_monitor | 4.3 | - | - |
cpe:2.3:a:oracle:communications_operations_monitor:4.3:*:*:*:*:*:*:*
|
| oracle | communications_operations_monitor | 4.4 | - | - |
cpe:2.3:a:oracle:communications_operations_monitor:4.4:*:*:*:*:*:*:*
|
| oracle | communications_operations_monitor | 5.0 | - | - |
cpe:2.3:a:oracle:communications_operations_monitor:5.0:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
参考链接
cve.org
cve.org
cve.org
cve.org
cve.org
cve.org
cve.org
cve.org
cve.org
cve.org
CVSS评分详情
3.1 (cna)
HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2021-32675 |
2025-11-11 15:20:58 | 2025-11-11 07:36:52 |
| NVD | nvd_CVE-2021-32675 |
2025-11-11 14:57:43 | 2025-11-11 07:45:11 |
| CNNVD | cnnvd_CNNVD-202110-137 |
2025-11-11 15:10:44 | 2025-11-11 07:56:57 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202110-137
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 3 -> 14
- data_sources: ['cve'] -> ['cve', 'nvd']