CVE-2021-31294: Medium severity Redis redis vulnerability
Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command (specifically, a SET command). NOTE: this was fixed for Redis 6.2.x and 7.x in 2021. Versions before 6.2 were not intended to have safety guarantees related to this.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-31294?
CVE-2021-31294 is a vulnerability in Redis versions before 6.2.0 that allows a replica to cause an assertion failure in a primary server by sending a non-administrative command.
What is the severity of CVE-2021-31294?
The severity of CVE-2021-31294 is medium with a CVSS score of 5.9.
How can I fix CVE-2021-31294?
To fix CVE-2021-31294, upgrade to Redis version 6.2.0 or later.
Is Redis version 6.2.0 affected by CVE-2021-31294?
No, Redis version 6.2.0 and later are not affected by CVE-2021-31294.
Where can I find more information about CVE-2021-31294?
You can find more information about CVE-2021-31294 on the Redis GitHub repository and the associated GitHub issues.