This page tracks the Alpine Linux fix status. The vulnerability itself is described on the main CVE page. View CVE-2022-35977 →

ALPINE-CVE-2022-35977

Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SETRANGE` and `SORT(_RO)` commands can trigger an...

Original description

The description as published by the source.

Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted SETRANGE and SORT(_RO) commands can trigger an integer overflow, resulting with Redis attempting to allocate impossible amounts of memory and abort with an out-of-memory (OOM) panic. The problem is fixed in Redis versions 7.0.8, 6.2.9 and 6.0.17. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Alpine:v3.14 redis

[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.2.9-r0"}]}]

Alpine:v3.15 redis

[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.2.9-r0"}]}]

Alpine:v3.16 redis

[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"7.0.8-r0"}]}]

Alpine:v3.17 redis

[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"7.0.8-r0"}]}]

Alpine:v3.18 redis

[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"7.0.8-r0"}]}]

Alpine:v3.19 redis

[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"7.0.8-r0"}]}]

References

advisory security.alpinelinux.org