CVE-2021-29477: 
Redis vulnerability analysis and mitigation

CVE-2021-29477 affects Redis, an open source in-memory data structure store, versions 6.0 and newer. The vulnerability was discovered and disclosed in May 2021, impacting Redis installations used as databases, caches, and message brokers (NVD, Redis Advisory).

The vulnerability is an integer overflow bug that can be exploited using the STRALGO LCS command to corrupt the heap. The issue has received a CVSS v3.1 base score of 8.8 (HIGH) from NVD and 7.5 (HIGH) from GitHub, with the vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-190 (Integer Overflow or Wraparound) (NVD).

The vulnerability could potentially result in remote code execution, allowing attackers to execute arbitrary code on affected systems. The impact affects system confidentiality, integrity, and availability, with the highest threat being to data security and system operations (Redis Advisory).

The vulnerability is fixed in Redis versions 6.2.3 and 6.0.13. For systems that cannot immediately patch, a workaround is available by using ACL configuration to prevent clients from using the STRALGO LCS command (Redis Advisory).