This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-29469 →

DEBIAN-CVE-2021-29469

Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages cou...

Original description

The description as published by the source.

Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. The issue is patched in version 3.1.1.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 node-redis

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2+~cs5.18.1-3"}]}]

Debian:13 node-redis

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2+~cs5.18.1-3"}]}]

Debian:14 node-redis

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2+~cs5.18.1-3"}]}]

References

advisory security-tracker.debian.org