Debian LTS: Security Advisory for redis (DLA-2810-1)

The remote host is missing an update for the 'redis' package(s) announced via the DLA-2810-1 advisory.

It was discovered that there were a number of issues in redis, a popular key-value database system: * CVE-2021-41099: Integer to heap buffer overflow handling certain string commands and network payloads, when proto-max-bulk-len is manually configured to a non-default, very large value. * CVE-2021-32762: Integer to heap buffer overflow issue in redis-cli and redis-sentinel parsing large multi-bulk replies on some older and less common platforms. * CVE-2021-32687: Integer to heap buffer overflow with intsets, when set-max-intset-entries is manually configured to a non-default, very large value. * CVE-2021-32675: Denial Of Service when processing RESP request payloads with a large number of elements on many connections. * CVE-2021-32672: Random heap reading issue with Lua Debugger. * CVE-2021-32626: Specially crafted Lua scripts may result with Heap buffer overflow.

'redis' package(s) on Debian Linux.

Checks if a vulnerable package version is present on the target host.

For Debian 9 'Stretch', this problem has been fixed in version 3:3.2.6-3+deb9u8. We recommend that you upgrade your redis packages.