Alerts This Week
Warning Icon 1 684
Alerts This Week
Warning Icon 1 684

openSUSE: 2021:0682-1 Important Redis Fix - Security Update

opensuse
Calendar Grey May 7, 2021
Dist Opensuse Esm H88
This release for Fedora tackles various security vulnerabilities and offers significant improvements and bug fixes. Maintain your safety.
An update that solves three vulnerabilities, contains 8 features and has one errata is now available

Description

This update for redis fixes the following issues:

redis 6.0.13

* CVE-2021-29477: Integer overflow in STRALGO LCS command (boo#1185729)

* CVE-2021-29478: Integer overflow in COPY command for large intsets

(boo#1185730)

* Cluster: Skip unnecessary check which may prevent failure detection

* Fix performance regression in BRPOP on Redis 6.0

* Fix edge-case when a module client is unblocked

redis 6.0.12:

* Fix compilation error on non-glibc systems if jemalloc is not used

redis 6.0.11:

* CVE-2021-21309: Avoid 32-bit overflows when proto-max-bulk-len is set

high (boo#1182657)

* Fix handling of threaded IO and CLIENT PAUSE (failover), could lead to

data loss or a crash

* Fix the selection of a random element from large hash tables

* Fix broken protocol in client tracking tracking-redir-broken message

* XINFO able to access expired keys on a replica

* Fix broken protocol in redis-benchmark when used with -a or --dbnum

*...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory security update buffer overflow integer overflow data loss important fix openSUSE redis

Patch

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.2:

zypper in -t patch openSUSE-2021-682=1

Package List

- openSUSE Leap 15.2 (i586 x86_64):

redis-6.0.13-lp152.2.3.1

redis-debuginfo-6.0.13-lp152.2.3.1

redis-debugsource-6.0.13-lp152.2.3.1

References

https://www.suse.com/security/cve/CVE-2021-21309.html

https://www.suse.com/security/cve/CVE-2021-29477.html

https://www.suse.com/security/cve/CVE-2021-29478.html

https://bugzilla.suse.com/1178205

https://bugzilla.suse.com/1182657

https://bugzilla.suse.com/1185729

https://bugzilla.suse.com/1185730

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2021:0682-1
Rating: important
Affected Products: openSUSE Leap 15.2 ble.

Topics%20covered

Topics Covered

security advisory security update buffer overflow integer overflow data loss important fix openSUSE redis

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here