Synopsis

Important: redis:5 security update

Type/Severity

Security Advisory: Important

Topic

An update for the redis:5 module is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.

Security Fix(es):

• redis: Heap buffer overflow in HyperLogLog triggered by malicious client (CVE-2019-10192)
  
• redis: Stack buffer overflow in HyperLogLog triggered by malicious client (CVE-2019-10193)
  

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for ARM 64 8 aarch64

Fixes

• BZ - 1723918 - CVE-2019-10192 redis: Heap buffer overflow in HyperLogLog triggered by malicious client
• BZ - 1727668 - CVE-2019-10193 redis: Stack buffer overflow in HyperLogLog triggered by malicious client

CVEs

• CVE-2019-10192
• CVE-2019-10193

References

• https://access.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux for x86_64 8

SRPM
redis-5.0.3-2.module+el8.0.0.z+3657+acb471dc.src.rpm	SHA-256: c56c4407c8ff79ec899821ca8102a1b150bb07f3661b96f1ecdabeca52323455
x86_64
redis-5.0.3-2.module+el8.0.0.z+3657+acb471dc.x86_64.rpm	SHA-256: 1820ee37465b59164b07c6ef754366ff6dc615ab2f8f4a61074ccae6bf33d14f
redis-debuginfo-5.0.3-2.module+el8.0.0.z+3657+acb471dc.x86_64.rpm	SHA-256: 7dd780088f59c72e47a5b0e0aefff597da7cd4d3aa47142c5a57f0fc30b7c97b
redis-debugsource-5.0.3-2.module+el8.0.0.z+3657+acb471dc.x86_64.rpm	SHA-256: 90348bf23b7cf2ec9716f797f61d21fd0a10e46f8058760a50481f1a89725d0c
redis-devel-5.0.3-2.module+el8.0.0.z+3657+acb471dc.x86_64.rpm	SHA-256: 412a735ec39b7cd8c48aa7417eec41e20bcdaff0ec4b3008f973a4c11098348c
redis-doc-5.0.3-2.module+el8.0.0.z+3657+acb471dc.noarch.rpm	SHA-256: 1bca0b2c40f13935808ea7738db8c87e6e53a668e8e420dd8e2bd203b6490ec8

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
redis-5.0.3-2.module+el8.0.0.z+3657+acb471dc.src.rpm	SHA-256: c56c4407c8ff79ec899821ca8102a1b150bb07f3661b96f1ecdabeca52323455
s390x
redis-doc-5.0.3-2.module+el8.0.0.z+3657+acb471dc.noarch.rpm	SHA-256: 1bca0b2c40f13935808ea7738db8c87e6e53a668e8e420dd8e2bd203b6490ec8
redis-5.0.3-2.module+el8.0.0.z+3657+acb471dc.s390x.rpm	SHA-256: 4758a13844750542477932224be2340aaedce37b818201fe7abcb0ecf5371b2b
redis-debuginfo-5.0.3-2.module+el8.0.0.z+3657+acb471dc.s390x.rpm	SHA-256: 0138f12b1af65c975d0f15b7487053bbf30ae5fee8dd4a45a0476fa28a90058c
redis-debugsource-5.0.3-2.module+el8.0.0.z+3657+acb471dc.s390x.rpm	SHA-256: d31e0054628af8f298b794eebdd0fdd94c69c7dca03d0b401b76779aa2d9069c
redis-devel-5.0.3-2.module+el8.0.0.z+3657+acb471dc.s390x.rpm	SHA-256: 3e504b1a075240fe2f814a8f95496c131e331d5d92124927bb5bce0eadd657a7

Red Hat Enterprise Linux for Power, little endian 8

SRPM
redis-5.0.3-2.module+el8.0.0.z+3657+acb471dc.src.rpm	SHA-256: c56c4407c8ff79ec899821ca8102a1b150bb07f3661b96f1ecdabeca52323455
ppc64le
redis-doc-5.0.3-2.module+el8.0.0.z+3657+acb471dc.noarch.rpm	SHA-256: 1bca0b2c40f13935808ea7738db8c87e6e53a668e8e420dd8e2bd203b6490ec8
redis-5.0.3-2.module+el8.0.0.z+3657+acb471dc.ppc64le.rpm	SHA-256: 444fb8408334e57d9c6e6e64ae44ae9c5d630b03759b190619b6cd8615e69b23
redis-debuginfo-5.0.3-2.module+el8.0.0.z+3657+acb471dc.ppc64le.rpm	SHA-256: baae77a594d38b2cd08d6aff236bd826fc38f9ffe21805f2dc4c2b0d5963da70
redis-debugsource-5.0.3-2.module+el8.0.0.z+3657+acb471dc.ppc64le.rpm	SHA-256: 669d9871aa4ca7f77ea7849243f293792000af11b7f30e95e2f970f466715513
redis-devel-5.0.3-2.module+el8.0.0.z+3657+acb471dc.ppc64le.rpm	SHA-256: 6aa23f3b91cbedec18067c7565e58b23cd6d221e28d2610d1b41bdf8b43bb74a

Red Hat Enterprise Linux for ARM 64 8

SRPM
redis-5.0.3-2.module+el8.0.0.z+3657+acb471dc.src.rpm	SHA-256: c56c4407c8ff79ec899821ca8102a1b150bb07f3661b96f1ecdabeca52323455
aarch64
redis-doc-5.0.3-2.module+el8.0.0.z+3657+acb471dc.noarch.rpm	SHA-256: 1bca0b2c40f13935808ea7738db8c87e6e53a668e8e420dd8e2bd203b6490ec8
redis-5.0.3-2.module+el8.0.0.z+3657+acb471dc.aarch64.rpm	SHA-256: c0e4c4affef8d396473d1c1c8427c3558fe464c04c4157660ad878cb81be2499
redis-debuginfo-5.0.3-2.module+el8.0.0.z+3657+acb471dc.aarch64.rpm	SHA-256: 9a09e95cf6382c961883b22237bbf3ccd5a8d455921767929de8cb44ec53dd45
redis-debugsource-5.0.3-2.module+el8.0.0.z+3657+acb471dc.aarch64.rpm	SHA-256: d0f5485f6b41a1af298cd944975ec2b96159e9e2ee0b847eec26955fa49bbde1
redis-devel-5.0.3-2.module+el8.0.0.z+3657+acb471dc.aarch64.rpm	SHA-256: 27ea289e03127b62b98dab9bf0485859312c1b80fc824929c3395f21ea542b5b