Cette page suit l'état du correctif pour Alpine Linux. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2022-35977 →
ALPINE-CVE-2022-35977
Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SETRANGE` and `SORT(_RO)` commands can trigger an...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted SETRANGE and SORT(_RO) commands can trigger an integer overflow, resulting with Redis attempting to allocate impossible amounts of memory and abort with an out-of-memory (OOM) panic. The problem is fixed in Redis versions 7.0.8, 6.2.9 and 6.0.17. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Alpine:v3.14
redis
[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.2.9-r0"}]}]
Alpine:v3.15
redis
[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.2.9-r0"}]}]
Alpine:v3.16
redis
[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"7.0.8-r0"}]}]
Alpine:v3.17
redis
[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"7.0.8-r0"}]}]
Alpine:v3.18
redis
[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"7.0.8-r0"}]}]
Alpine:v3.19
redis
[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"7.0.8-r0"}]}]
Références
- advisory security.alpinelinux.org