redis:6 security update
エラータID: AXSA:2021-2227:01
リリース日:
2021/07/19 Monday - 13:41
題名:
redis:6 security update
影響のあるチャネル:
Asianux Server 8 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- Redis には整数オーバーフローの問題があり、 "STRALGO LCS" コマンドを使用するこ
とで、ヒープ領域を破壊し、結果リモートでコードが実行される脆弱性があります。クラ
イアントが "STRALGO LCS" コマンドを使用できないように ACL を設定することで、脆
弱性による問題を軽減できます。(CVE-2021-29477)
Modularity name: redis
Stream name: 6
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2021-29477
Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer could be exploited using the `STRALGO LCS` command to corrupt the heap and potentially result with remote code execution. The problem is fixed in version 6.2.3 and 6.0.13. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the `STRALGO LCS` command.
Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer could be exploited using the `STRALGO LCS` command to corrupt the heap and potentially result with remote code execution. The problem is fixed in version 6.2.3 and 6.0.13. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the `STRALGO LCS` command.
追加情報:
N/A
ダウンロード:
SRPMS
- redis-6.0.9-3.module+el8+1270+9441336f.src.rpm
MD5: d8938d0ce82a40033130dcdf84d5468b
SHA-256: d82da12fa98716edefd9671c909ddfe024ac67e7a063ce6a2d4eb5bb46839ddf
Size: 2.76 MB
Asianux Server 8 for x86_64
- redis-6.0.9-3.module+el8+1270+9441336f.x86_64.rpm
MD5: ed028b4e82c68d47b703ed036012bba5
SHA-256: 65f25b0e5e5cc9a86f425bf41eb694c3c27b6287a1c66f09983455acd06b7334
Size: 1.08 MB - redis-debugsource-6.0.9-3.module+el8+1270+9441336f.x86_64.rpm
MD5: 406f59090fa913788f6b78aba075d099
SHA-256: 95a07f8400620d884a40dd56b1f42d20721245699cb4b38ab86a6d0b980cb383
Size: 1.23 MB - redis-devel-6.0.9-3.module+el8+1270+9441336f.x86_64.rpm
MD5: 1717bd8e4f147e1558b4fa0ab5e735fc
SHA-256: 93ac620a54c53018611c01a182d2563a81747f6b0e52c82177e66d7e7368f372
Size: 28.42 kB - redis-doc-6.0.9-3.module+el8+1270+9441336f.noarch.rpm
MD5: e613b0366ead59ec6a915bcb922a5774
SHA-256: b95b2f7518496e8a480f467a05075d028e14cb35a2b7350a3a981724a4d48150
Size: 507.61 kB
English