Bug 31616 - Redis Security Update - CVE-2023-25155, CVE-2022-36021
Summary: Redis Security Update - CVE-2023-25155, CVE-2022-36021
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks: 31174
  Show dependency treegraph
 
Reported: 2023-03-01 14:45 CET by Stig-Ørjan Smelror
Modified: 2023-04-20 17:51 CEST (History)
4 users (show)

See Also:
Source RPM:
CVE: CVE-2023-25155, CVE-2022-36021
Status comment:


Attachments

Description Stig-Ørjan Smelror 2023-03-01 14:45:59 CET
(CVE-2023-25155) Specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD
commands can trigger an integer overflow, resulting in a runtime assertion
and termination of the Redis server process.

(CVE-2022-36021) String matching commands (like SCAN or KEYS) with a specially
crafted pattern to trigger a denial-of-service attack on Redis, causing it to
hang and consume 100% CPU time.

Fixed in 6.0.18.
https://github.com/redis/redis/releases/tag/6.0.18
Comment 1 Stig-Ørjan Smelror 2023-03-01 14:52:12 CET
Advisory
========

Redis version 7.0.9 contains an update to 2 critical security issues.

(CVE-2023-25155) Specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD
commands can trigger an integer overflow, resulting in a runtime assertion
and termination of the Redis server process.

(CVE-2022-36021) String matching commands (like SCAN or KEYS) with a specially
crafted pattern to trigger a denial-of-service attack on Redis, causing it to
hang and consume 100% CPU time.


References
==========
https://github.com/redis/redis/releases/tag/6.0.18


Files
=====

Uploaded to core/updates_testing

redis-6.0.18-1.mga8

from redis-6.0.18-1.mga8.src.rpm

Assignee: smelror => qa-bugs

Stig-Ørjan Smelror 2023-03-01 14:56:41 CET

CVE: (none) => CVE-2023-25155, CVE-2022-36021

Comment 2 Len Lawrence 2023-03-01 21:25:51 CET
Updated the package for Mageia8, x86_64.
Restarted the redis server.
Referred to earlier bugs which used a condensed tutorial script.  Fed that to the command line application and saw the expected results, as on all other occasions.
$ redis-cli < tutorial
OK
"rapunzel"
OK
(integer) 8
(integer) 9
"9"
(integer) 1
(integer) 1
OK
[...]

IIRC redis creates a database in RAM which hangs around to act as an active container for numerical and text data at least and provides some extra functionality, like arithmetic.

$ urpmq --whatrequires-recursive redis
ntopng
redis

# ntopng -i eno1 > session.ntopng
^C^C
# head session.ntopng 
01/Mar/2023 20:12:39 [Ntop.cpp:2336] Setting local networks to 127.0.0.0/8,fe80::/10
01/Mar/2023 20:12:39 [Redis.cpp:157] Successfully connected to redis 127.0.0.1:6379@0
01/Mar/2023 20:12:39 [Redis.cpp:157] Successfully connected to redis 127.0.0.1:6379@0
01/Mar/2023 20:12:40 [PcapInterface.cpp:93] Reading packets from eno1 [id: 0]
01/Mar/2023 20:12:40 [Ntop.cpp:2441] Registered interface eno1 [id: 0]
01/Mar/2023 20:12:40 [main.cpp:312] PID stored in file /var/run/ntopng/ntopng.pid
01/Mar/2023 20:12:40 [Geolocation.cpp:107] Running without geolocation support.
01/Mar/2023 20:12:40 [Geolocation.cpp:108] To enable geolocation follow the instructions at
01/Mar/2023 20:12:40 [Geolocation.cpp:109] https://github.com/ntop/ntopng/blob/dev/doc/README.geolocation.md
01/Mar/2023 20:12:40 [HTTPserver.cpp:1529] Web server dirs [/usr/share/ntopng/httpdocs][/usr/share/ntopng/scripts]
# cat /var/run/ntopng/ntopng.pid
1507319
$ ps aux | grep ntopng
ntopng   1507319  1.9  0.6 3022956 214028 pts/7  SLl+ 20:18   0:03 ntopng -i eno1

Fair enough.  Letting this go.

CC: (none) => tarazed25
Whiteboard: (none) => MGA8-64-OK

Comment 3 Thomas Andrews 2023-03-02 14:04:31 CET
Validating. Advisory in comment 1.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Dave Hodgins 2023-03-10 00:23:37 CET

Keywords: (none) => advisory
CC: (none) => davidwhodgins

Comment 4 Mageia Robot 2023-03-11 20:02:02 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2023-0086.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED

David Walser 2023-04-20 17:50:38 CEST

Blocks: (none) => 31174

Comment 5 David Walser 2023-04-20 17:51:18 CEST
CVE-2022-35977 was also fixed in this update (Bug 31174).

Note You need to log in before you can comment on or make changes to this bug.