Security Redis 3.2.4 Security Update

eva2000 · Sep 27, 2016

Redis 3.2.4 security update is released Redis 3.2.4 is out [SECURITY BUG!] : redis

Redis 3.2.4 Released Mon Sep 26 08:58:21 CEST 2016
Upgrade urgency CRITICAL: Redis 3.2 and unstable contained a security vulnerability fixed by this release.

Hello Redis Wizards of the Memory Stores Empire,

this is a Redis critical release in order to fix a security issue which is documented clearly here:

Security: CONFIG SET client-output-buffer-limit overflow fixed. · antirez/redis@6d9f8e2 · GitHub

Thanks to Cory Duplantis of Cisco Talos for reporting the issue.

IMPACT:

The gist is that using CONFIG SET calls (or by manipulating redis.conf) an attacker is able to compromise certain fields of the "server" global structure, including the aof filename pointer, that could be made pointing to something else. In turn the AOF name is used in different contexts such as logging, rename(2) and open(2) syscalls, leading to potential problems.

Please note that since having access to CONFIG SET also means to be able to change the AOF filename (and many other things) directly, this issue actual real world impact is quite small, so I would not panik: if you have CONFIG SET level of access, you can do more and more easily.

AFFECTED VERSIONS:

All Redis 3.2.x versions are affected.

OTHER CHANGES IN THIS RELEASE:

This release also includes other things:

TCP binding bug fixed when only certain addresses were available for a given port.
A much better crash report that includes part of the Redis binary: this will allow to fix bugs even when we just have a crash log and no other help from the original poster oft the issue.

A fix for Redis Cluster redis-trib displaying of info after creating a new cluster.

Click to expand...

Centmin Mod does not install Redis out of the box. So if you have installed Redis server, you will need to update it via YUM update
Code (Text):
yum -y update --disableplugin=priorities --enablerepo=remi

Log in / Register

Forums

Join the community today

Security Redis 3.2.4 Security Update

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Join the community today

Security Redis 3.2.4 Security Update

eva2000 Administrator Staff Member

.