Red Hat Product Errata RHSA-2025:0595 - Security Advisory
Issued:
2025-01-22
Updated:
2025-01-22

RHSA-2025:0595 - Security Advisory

Synopsis

Important: redis:6 security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for the redis:6 module is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.

Security Fix(es):

  • redis: Integer overflow in the Redis HRANDFIELD and ZRANDMEMBER commands may lead to denial-of-service (CVE-2023-22458)
  • redis: Integer overflow in the Redis SETRANGE and SORT/SORT_RO commands may result with false OOM panic (CVE-2022-35977)
  • redis: Specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD commands can trigger an integer overflow (CVE-2022-36021)
  • redis: String matching commands (like SCAN or KEYS) with a specially crafted pattern to trigger a denial-of-service attack (CVE-2023-25155)
  • redis: Insufficient validation of HINCRBYFLOAT command (CVE-2023-28856)
  • redis: heap overflow in the lua cjson and cmsgpack libraries (CVE-2022-24834)
  • redis: possible bypass of Unix socket permissions on startup (CVE-2023-45145)
  • redis: Lua library commands may lead to stack overflow and RCE in Redis (CVE-2024-31449)
  • redis: Denial-of-service due to unbounded pattern matching in Redis (CVE-2024-31228)
  • redis: Redis' Lua library commands may lead to remote code execution (CVE-2024-46981)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64

Fixes

  • BZ - 2163132 - CVE-2023-22458 redis: Integer overflow in the Redis HRANDFIELD and ZRANDMEMBER commands may lead to denial-of-service
  • BZ - 2163133 - CVE-2022-35977 redis: Integer overflow in the Redis SETRANGE and SORT/SORT_RO commands may result with false OOM panic
  • BZ - 2174305 - CVE-2022-36021 redis: Specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD commands can trigger an integer overflow
  • BZ - 2174306 - CVE-2023-25155 redis: String matching commands (like SCAN or KEYS) with a specially crafted pattern to trigger a denial-of-service attack
  • BZ - 2187525 - CVE-2023-28856 redis: Insufficient validation of HINCRBYFLOAT command
  • BZ - 2221662 - CVE-2022-24834 redis: heap overflow in the lua cjson and cmsgpack libraries
  • BZ - 2244940 - CVE-2023-45145 redis: possible bypass of Unix socket permissions on startup
  • BZ - 2317056 - CVE-2024-31449 redis: Lua library commands may lead to stack overflow and RCE in Redis
  • BZ - 2317058 - CVE-2024-31228 redis: Denial-of-service due to unbounded pattern matching in Redis
  • BZ - 2336004 - CVE-2024-46981 redis: Redis' Lua library commands may lead to remote code execution
  • RHEL-66165 - redis:6 rebase to 6.2.16

Red Hat Enterprise Linux for x86_64 8

SRPM
redis-6.2.17-1.module+el8.10.0+22680+748527fd.src.rpm SHA-256: 8cf6dfcd466b473b84fae43b77b1e2f35cb82930a5769214618a290675bf3e89
x86_64
redis-doc-6.2.17-1.module+el8.10.0+22680+748527fd.noarch.rpm SHA-256: ef4645862c84f1b595ed99e8e248d091215853a995a550ed2d319bc288f1cbf3
redis-6.2.17-1.module+el8.10.0+22680+748527fd.x86_64.rpm SHA-256: 1f518512ff9700b176d2b26e13afe59d92163950dd4a7cd32b576e1916317c25
redis-debuginfo-6.2.17-1.module+el8.10.0+22680+748527fd.x86_64.rpm SHA-256: 24164eaf1910cfd65c719a93d9ac98cad81ac1cd96fd4db9034d12929817cfcd
redis-debugsource-6.2.17-1.module+el8.10.0+22680+748527fd.x86_64.rpm SHA-256: 3598d1e35b58178aaa478f006ba306300ba587a6f05a067b42ae7fb3a4f93427
redis-devel-6.2.17-1.module+el8.10.0+22680+748527fd.x86_64.rpm SHA-256: 5120ae9117c4a238bfbe45667fe07728970aced2c8d7344abcbbdc813f631d90

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
redis-6.2.17-1.module+el8.10.0+22680+748527fd.src.rpm SHA-256: 8cf6dfcd466b473b84fae43b77b1e2f35cb82930a5769214618a290675bf3e89
s390x
redis-doc-6.2.17-1.module+el8.10.0+22680+748527fd.noarch.rpm SHA-256: ef4645862c84f1b595ed99e8e248d091215853a995a550ed2d319bc288f1cbf3
redis-6.2.17-1.module+el8.10.0+22680+748527fd.s390x.rpm SHA-256: 618c41595b9087791ea170540b4c95899b22f692cf5f10af081a02e0cdbc2430
redis-debuginfo-6.2.17-1.module+el8.10.0+22680+748527fd.s390x.rpm SHA-256: 709f50e4a42645b5bc7155def9fd77cc88de65370e2184c54bceb44a031a5cd5
redis-debugsource-6.2.17-1.module+el8.10.0+22680+748527fd.s390x.rpm SHA-256: 936c7880e4d477c848b607b505eeb03cb71a28511f3e70200cbaf0fe7d59a317
redis-devel-6.2.17-1.module+el8.10.0+22680+748527fd.s390x.rpm SHA-256: 6dad03cb547931beae2c9fe16858e9ba94d5788907ca36a9e9798347de52a3df

Red Hat Enterprise Linux for Power, little endian 8

SRPM
redis-6.2.17-1.module+el8.10.0+22680+748527fd.src.rpm SHA-256: 8cf6dfcd466b473b84fae43b77b1e2f35cb82930a5769214618a290675bf3e89
ppc64le
redis-doc-6.2.17-1.module+el8.10.0+22680+748527fd.noarch.rpm SHA-256: ef4645862c84f1b595ed99e8e248d091215853a995a550ed2d319bc288f1cbf3
redis-6.2.17-1.module+el8.10.0+22680+748527fd.ppc64le.rpm SHA-256: 46f9132a011d232b2f0ab17ed6f2d9df0a98fd031e78f7c5c6485da957d7102f
redis-debuginfo-6.2.17-1.module+el8.10.0+22680+748527fd.ppc64le.rpm SHA-256: d6ccbfebe435b86a234ee56069645cb91ffa50519f62547358b24511afa4dd5f
redis-debugsource-6.2.17-1.module+el8.10.0+22680+748527fd.ppc64le.rpm SHA-256: 2e5793242449cb10357afa9202da61d8644a35b71264b79c12345b94e3ce95eb
redis-devel-6.2.17-1.module+el8.10.0+22680+748527fd.ppc64le.rpm SHA-256: b4f769d807cf6f392d5c8fa92274135e5968f1bd95fd9dc5df45a5ec84f14098

Red Hat Enterprise Linux for ARM 64 8

SRPM
redis-6.2.17-1.module+el8.10.0+22680+748527fd.src.rpm SHA-256: 8cf6dfcd466b473b84fae43b77b1e2f35cb82930a5769214618a290675bf3e89
aarch64
redis-6.2.17-1.module+el8.10.0+22680+748527fd.aarch64.rpm SHA-256: 26b0cdb2ac1a51657ef24eface222ccdaf08b37adba6753117c3d373bf9d7a2f
redis-debuginfo-6.2.17-1.module+el8.10.0+22680+748527fd.aarch64.rpm SHA-256: c643e3a04db2e4e4c002ae27330f6133f59a4c052e29ac2780e8ca190e91f5e4
redis-debugsource-6.2.17-1.module+el8.10.0+22680+748527fd.aarch64.rpm SHA-256: 8d03dcdf47bbe4bd14201ea67669e538f18e7609b52ae711f909f69fbb43840e
redis-devel-6.2.17-1.module+el8.10.0+22680+748527fd.aarch64.rpm SHA-256: 856396234fe3449094f75a51bc5edcb18ce98938a2492566214e1fcaea0255f4
redis-doc-6.2.17-1.module+el8.10.0+22680+748527fd.noarch.rpm SHA-256: ef4645862c84f1b595ed99e8e248d091215853a995a550ed2d319bc288f1cbf3

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.