CVE-2021-32625

A flaw was found in Redis. An integer overflow could be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

This issue only affects 32-bit Redis version 6.0 or newer. The Redis module streams shipped with Red Hat Enterprise Linux 8 are not affected by this flaw:

• redis:5 does not include a vulnerable version of Redis.
• redis:6 does not provide support for 32-bit Redis.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.