Out-of-bounds Read in NetApp Management Services For Element Software
CVE-2021-32672
Redis is an open source, in-memory database that persists on disk. When using the Redis Lua Debugger, users can send malformed requests that cause the debugger’s protocol parser to read data beyond the actual buffer. This issue affects all versions of Redis with Lua debugging support (3.2 or newer). The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.017 (76.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 77th percentile — 76.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.018 · newest: 0.017 · change: -0.001
Affected products
- NetApp Management Services For Element Software
- NetApp Management Services For Hci
- Oracle Communications Operations Monitor — versions 4.3, 4.4, 5.0
- Redis — versions >= 3.2.0, < 5.0.14, >= 6.0.0, < 6.0.16, >= 6.0.0, < 6.2.6
- Debian Linux — versions 10.0, 11.0
- Fedoraproject Fedora — versions 33, 34, 35
- Red Hat Enterprise Linux — versions 8.0
- Red Hat Software Collections
Weakness classification (CWE)
References
- github.com/redis/redis/security/advisories/GHSA-9mj9-xx53-qmxm (Third Party Advisory)
- github.com/redis/redis/commit/6ac3c0b7abd35f37201ed2d6298ecef4ea1ae1dd (Patch, Third Party Advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- www.debian.org/security/2021/dsa-5001 (vendor-advisory, Third Party Advisory)
- www.oracle.com/security-alerts/cpuapr2022.html (Patch, Third Party Advisory)
- security.netapp.com/advisory/ntap-20211104-0003/ (Third Party Advisory)
- security.gentoo.org/glsa/202209-17 (vendor-advisory, Third Party Advisory)
Frequently asked questions
- What is CVE-2021-32672?
- CVE-2021-32672 is a medium-severity vulnerability in NetApp Management Services For Element Software, classified under Out-of-bounds Read. CVSS score: 5.3/10. Published 2021-10-04.
- How severe is CVE-2021-32672?
- Medium severity. CVSS v3 base score is 5.3 out of 10.