QwikSec

Security Database

CVE

CWE

Training

CVE-2021-29469

Published: Apr 23, 2021

Modified: Aug 3, 2024

PUBLISHED

CVSS v3.1

5.3

MEDIUM

Description

Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. The issue is patched in version 3.1.1.

Vendor	Product	Versions
NodeRedis	node-redis	affected `< 3.1.1`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

References

https://github.com/NodeRedis/node-redis/security/advisories/GHSA-35q2-47q7-3pc3

x_refsource_CONFIRM

https://github.com/NodeRedis/node-redis/commit/2d11b6dc9b9774464a91fb4b448bad8bf699629e

x_refsource_MISC

https://github.com/NodeRedis/node-redis/releases/tag/v3.1.1

x_refsource_MISC

https://security.netapp.com/advisory/ntap-20210611-0010/

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.