CVE-2016-2121: Medium severity red hat openstack for ibm power vulnerability
A permissions flaw was found in redis, which sets weak permissions on certain files and directories that could potentially contain sensitive information. A local, unprivileged user could possibly use this flaw to access unauthorized system information.
Other sources
It was found that redis set weak permissions on certain files that could potentially contain sensitive information:
-rw-r--r--. 1 redis root 41599 Feb 8 2016 /etc/redis.conf -rw-r--r--. 1 redis root 7355 Feb 8 2016 /etc/redis-sentinel.conf drwxr-xr-x. 2 redis redis 4096 Sep 9 14:29 /var/lib/redis
This issue was originally reported in bug 1374700.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2121?
CVE-2016-2121 is considered a moderate severity vulnerability due to the potential for unauthorized access to sensitive information.
How do I fix CVE-2016-2121?
To fix CVE-2016-2121, ensure that Redis is configured to use proper file permissions and consider upgrading to a patched version of the affected software.
Who is affected by CVE-2016-2121?
CVE-2016-2121 affects users of Red Hat OpenStack 10 where Redis is deployed with weak file permissions.
What types of systems are impacted by CVE-2016-2121?
CVE-2016-2121 impacts systems running Redis within the Red Hat OpenStack 10 environment.
Can CVE-2016-2121 be exploited remotely?
CVE-2016-2121 is primarily a local vulnerability, meaning it requires local access to exploit.