SUSE-SU-2024:0200-1: Security update for redis7

Q: Which deployments are most likely to be exposed to this issue?

Deployments of redis7 using a UNIX socket are the relevant population, because the flaw occurs during UNIX socket creation. The advisory applies to the listed SUSE openSUSE Leap 15.5 and SUSE Server Applications Module 15-SP5 architectures.

Q: What must occur for an attacker to exploit the vulnerability?

The issue is a race condition during UNIX socket creation that can result in a potential permission bypass. The provided advisory does not specify attacker access requirements or a concrete exploitation sequence.

Q: What should operators verify after applying the update?

Verify that Redis services are running after the upgrade. The update also fixes an issue that caused Redis services to be disabled after an upgrade.

Published Jan 23, 2024

Updated

This update for redis7 fixes the following issues: CVE-2023-45145: Fixed a potential permission bypass due to a race condition during UNIX socket creation (bsc#1216376). The following non-security issues were fixed: Redis services are no longer disabled after an upgrade (bsc#1212119).

Affected Software

8 affected componentsFixes available

All of the following

SUSE openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586)

Any of the following

suse/redis7-debuginfo<7.0.8-150500.3.9.1

7.0.8-150500.3.9.1

suse/redis7<7.0.8-150500.3.9.1

7.0.8-150500.3.9.1

suse/redis7-debugsource<7.0.8-150500.3.9.1

7.0.8-150500.3.9.1

All of the following

SUSE Server Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/redis7-debuginfo<7.0.8-150500.3.9.1

7.0.8-150500.3.9.1

suse/redis7<7.0.8-150500.3.9.1

7.0.8-150500.3.9.1

suse/redis7-debugsource<7.0.8-150500.3.9.1

7.0.8-150500.3.9.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/redis7-debuginfo to a version that resolves this vulnerability.
Fixed in 7.0.8-150500.3.9.1
Upgrade
Upgrade suse/redis7 to a version that resolves this vulnerability.
Fixed in 7.0.8-150500.3.9.1
Upgrade
Upgrade suse/redis7-debugsource to a version that resolves this vulnerability.
Fixed in 7.0.8-150500.3.9.1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-2024-200=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-SLE-15.5-2024-200=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Server-Applications-15-SP5-2024-200=1

Event History

Jan 23, 2024

Advisory Published

via SUSE·08:30 PM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2023-45145

Frequently Asked Questions

Which deployments are most likely to be exposed to this issue?

Deployments of redis7 using a UNIX socket are the relevant population, because the flaw occurs during UNIX socket creation. The advisory applies to the listed SUSE openSUSE Leap 15.5 and SUSE Server Applications Module 15-SP5 architectures.

What must occur for an attacker to exploit the vulnerability?

The issue is a race condition during UNIX socket creation that can result in a potential permission bypass. The provided advisory does not specify attacker access requirements or a concrete exploitation sequence.

What should operators verify after applying the update?

Verify that Redis services are running after the upgrade. The update also fixes an issue that caused Redis services to be disabled after an upgrade.

SUSE-SU-2024:0200-1: Security update for redis7

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are most likely to be exposed to this issue?

What must occur for an attacker to exploit the vulnerability?

What should operators verify after applying the update?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most likely to be exposed to this issue?

What must occur for an attacker to exploit the vulnerability?

What should operators verify after applying the update?