REDHAT-BUG-894659: Low severity ioredis vulnerability
It seems that redis 2.4 use a predictible file name in /tmp/ as some kind of swap file :
server.vmswapfile = zstrdup("/tmp/redis-%p.vm");
this was removed in 2.6 ( deprecated code ), but 2.4 is in fedora 18 and epel 6 AFAIK.
Since redis do not care if the file exist or not before opening it ( and in fact, I think it try to reuse if it already exist ), this could be used by a attacker to erase a arbitrary file with a symlink to the file. Depending if redis is running as root or not, this could be dangerous, or just a minor nuisance.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-894659?
The severity of REDHAT-BUG-894659 is moderate, as the predictable file name in /tmp/ can lead to potential security risks.
How do I fix REDHAT-BUG-894659?
To fix REDHAT-BUG-894659, it is recommended to upgrade Redis to version 2.6 or later, where this issue has been resolved.
Which versions of Redis are affected by REDHAT-BUG-894659?
REDHAT-BUG-894659 affects Redis version 2.4 and earlier, as the predictable swap file issue was addressed in version 2.6.
Can the predictable swap file issue in REDHAT-BUG-894659 lead to data loss?
Yes, the predictable swap file issue in REDHAT-BUG-894659 can potentially lead to data loss or corruption if multiple instances of Redis are running on the same server.
Is REDHAT-BUG-894659 a common vulnerability?
Yes, REDHAT-BUG-894659 is a recognized vulnerability in older versions of Redis and is particularly noted in Fedora 18 and EPEL 6.