There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when
    using a heap allocator other than jemalloc or glibc's malloc, leading to potential out of bound write or
    process crash. Effectively this flaw does not affect the vast majority of users, who use jemalloc or glibc
    malloc. (CVE-2021-3470)

  - Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an
    integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and
    potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the
    maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the
    limit is significantly increased, receiving a large request from a client may trigger several integer
    overflow scenarios, which would result with buffer overflow and heap corruption. We believe this could in
    certain conditions be exploited for remote code execution. By default, authenticated Redis users have
    access to all configuration parameters and can therefore use the “CONFIG SET proto-max-bulk-len” to change
    the safe default, making the system vulnerable. **This problem only affects 32-bit Redis (on a 32-bit
    system, or as a 32-bit executable running on a 64-bit system).** The problem is fixed in version 6.2, and
    the fix is back ported to 6.0.11 and 5.0.11. Make sure you use one of these versions if you are running
    32-bit Redis. An additional workaround to mitigate the problem without patching the redis-server
    executable is to prevent clients from directly executing `CONFIG SET`: Using Redis 6.0 or newer, ACL
    configuration can be used to block the command. Using older versions, the `rename-command` configuration
    directive can be used to rename the command to a random string unknown to users, rendering it
    inaccessible. Please note that this workaround may have an additional impact on users or operational
    systems that expect `CONFIG SET` to behave in certain ways. (CVE-2021-21309)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when
    using a heap allocator other than jemalloc or glibc's malloc, leading to potential out of bound write or
    process crash. Effectively this flaw does not affect the vast majority of users, who use jemalloc or glibc
    malloc. (CVE-2021-3470)

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 使用除 jemalloc 或 glibc 的 malloc 之外的堆分配器时在低于 5.0.10的版本、低于 的 6.0.9 的版本和低于 的 6.2.0 的Redis 中发现堆溢出问题可能会造成越界写入或进程崩溃。实际上此缺陷不会影响绝大多数使用 jemalloc 或 glibc malloc 的用户。 (CVE-2021-3470)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 當使用 jemalloc 或 glibc 的 malloc 以外的堆積配置器時在 Redis 之前的版本、 5.0.106.0.9 之前的 版和 6.2.0 之前的 版中發現一個堆積溢位問題可能導致超出邊界寫入或處理程序損毀。實際上此瑕疵不會影響使用 jemalloc 或 glibc malloc 的絕大多數使用者。 (CVE-2021-3470)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - 5.0.10より前の 、 6.0.9 より前の 、 6.2.0 より前の のバージョンの Redis で、jemalloc または glibc の malloc 以外のヒープアロケーターを使用する際に、ヒープオーバーフローの問題が見つかりました。これにより、領域外書き込みまたはプロセスのクラッシュが発生する可能性があります。事実上、この欠陥は、jemalloc または glibc malloc を使用する多数のユーザーに影響を与えません。CVE-2021-3470

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

An update of the redis package has been released.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017408 advisory.

    A heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when     using a heap allocator other than jemalloc or glibc's malloc, leading to potential out of bound write or     process crash. Effectively this flaw does not affect the vast majority of users, who use jemalloc or glibc     malloc.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when     using a heap allocator other than jemalloc or glibc's malloc, leading to potential out of bound write or     process crash. Effectively this flaw does not affect the vast majority of users, who use jemalloc or glibc     malloc. (CVE-2021-3470)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
406913	Alpine: multiple redis packages: security update to 6.2.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2023/10/31	2026/7/2	high
406900	Alpine: multiple redis packages: security update to 5.0.11-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2023/10/31	2026/7/2	high
406900	Alpine: multiple redis packages: security update to 5.0.11-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2023/10/31	2026/7/2	high
406913	Alpine: multiple redis packages: security update to 6.2.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2023/10/31	2026/7/2	high
406912	Alpine: multiple redis packages: security update to 6.0.9-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2023/10/31	2026/7/2	medium
406912	Alpine: multiple redis packages: security update to 6.0.9-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2023/10/31	2026/7/2	medium
246392	Linux Distros 未修补的漏洞：CVE-2021-3470	Nessus	Misc.	2025/8/8	2026/7/12	medium
246392	Linux Distros 未修補的弱點：CVE-2021-3470	Nessus	Misc.	2025/8/8	2026/7/12	medium
246392	Linux Distros のパッチ未適用の脆弱性: CVE-2021-3470	Nessus	Misc.	2025/8/8	2026/7/12	medium
148813	Photon OS 3.0: Redis PHSA-2021-3.0-0220	Nessus	PhotonOS Local Security Checks	2021/4/20	2024/7/23	medium
313765	Unity Linux 20.1060e / 20.1070e Security Update: redis (UTSA-2026-017408)	Nessus	Unity Linux Local Security Checks	2026/5/11	2026/5/11	medium
148809	Photon OS 1.0: Redis PHSA-2021-1.0-0380	Nessus	PhotonOS Local Security Checks	2021/4/20	2021/4/21	medium
204322	Photon OS 4.0: Redis PHSA-2021-4.0-0008	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	medium
148824	Photon OS 2.0: Redis PHSA-2021-2.0-0336	Nessus	PhotonOS Local Security Checks	2021/4/20	2024/7/22	medium
246392	Linux Distros Unpatched Vulnerability : CVE-2021-3470	Nessus	Misc.	2025/8/8	2026/7/12	medium

检测

插件搜索

high

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium