Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Fedora 37: FEDORA-2023-8a9087f089 Critical Redis Race Condition

fedora
Calendar Grey October 27, 2023
Dist Fedora Esm H88
Crucial security patch released for Redis 7.0.14 on Fedora, rectifying severe race condition that allows evasion of socket access controls.
**Redis 7.0.14** Released Wed 18 Oct 2023 10:33:40 IDT Upgrade urgency SECURITY: See security fixes below

Summary

Redis is an advanced key-value store. It is often referred to as a data

structure server since keys can contain strings, hashes, lists, sets and

sorted sets.

You can run atomic operations on these types, like appending to a string;

incrementing the value in a hash; pushing to a list; computing set

intersection, union and difference; or getting the member with highest

ranking in a sorted set.

In order to achieve its outstanding performance, Redis works with an

in-memory dataset. Depending on your use case, you can persist it either

by dumping the dataset to disk every once in a while, or by appending

each command to a log.

Redis also supports trivial-to-setup master-slave replication, with very

fast non-blocking first synchronization, auto-reconnection on net split

and so forth.

Other features include Transactions, Pub/Sub, Lua scripting, Keys with a

limited time-to-live, and configuration settings to make Redis behave like

a cache.

You can use Redis from most programming languages also.

Update Information:

**Redis 7.0.14** Released Wed 18 Oct 2023 10:33:40 IDT Upgrade urgency SECURITY: See security fixes below. Security fixes * (**CVE-2023-45145**) The wrong order of listen(2) and chmod(2) calls creates a race condition that can be used by another process to bypass desired Unix socket permissions on startup.

Change Log

* Wed Oct 18 2023 Remi Collet - 7.0.14-1 - Upstream 7.0.14 release

References


[ 1 ] Bug #2244940 - CVE-2023-45145 redis: possible bypass of Unix socket permissions on startup https://bugzilla.redhat.com/show_bug.cgi?id=2244940

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-8a9087f089' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html

Severity
critical
Lowest
Low
Medium
High
Critical

Name: redis
Product: Fedora 37
Version: 7.0.14
Release: 1.fc37
Summary: A persistent key-value database

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here